[parent not found: <CAO7_G+xxRab6PJQnffPhpV+fiYbEj85bDOLYO6Uho360ohVYLw@mail.gmail.com>]
* Re: [syzbot] [block?] BUG: unable to handle kernel paging request in blk_mq_complete_request_remote
[not found] <CAO7_G+xxRab6PJQnffPhpV+fiYbEj85bDOLYO6Uho360ohVYLw@mail.gmail.com>
@ 2026-11-11 4:42 ` syzbot
0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2026-11-11 4:42 UTC (permalink / raw)
To: linux-kernel, nenkov2004, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: use-after-free Write in rht_lock
bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
bond0 (unregistering): Released all slaves
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
BUG: KASAN: use-after-free in test_and_set_bit_lock include/asm-generic/bitops/instrumented-lock.h:57 [inline]
BUG: KASAN: use-after-free in bit_spin_lock include/linux/bit_spinlock.h:40 [inline]
BUG: KASAN: use-after-free in rht_lock_nested include/linux/rhashtable.h:330 [inline]
BUG: KASAN: use-after-free in rht_lock+0x74/0x19c include/linux/rhashtable.h:339
Write of size 8 at addr ffff000139838a68 by task kworker/u8:7/1394
CPU: 1 UID: 0 PID: 1394 Comm: kworker/u8:7 Not tainted syzkaller #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
Workqueue: netns cleanup_net
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
__dump_stack+0x30/0x40 lib/dump_stack.c:94
dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
print_address_description+0xb0/0x238 mm/kasan/report.c:378
print_report+0x68/0x84 mm/kasan/report.c:482
kasan_report+0x8c/0xc4 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x17c/0x1ac mm/kasan/generic.c:200
__kasan_check_write+0x20/0x30 mm/kasan/shadow.c:37
instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
test_and_set_bit_lock include/asm-generic/bitops/instrumented-lock.h:57 [inline]
bit_spin_lock include/linux/bit_spinlock.h:40 [inline]
rht_lock_nested include/linux/rhashtable.h:330 [inline]
rht_lock+0x74/0x19c include/linux/rhashtable.h:339
__rhashtable_remove_fast_one include/linux/rhashtable.h:1069 [inline]
__rhashtable_remove_fast include/linux/rhashtable.h:1150 [inline]
rhashtable_remove_fast include/linux/rhashtable.h:1179 [inline]
tipc_sk_remove net/tipc/socket.c:3051 [inline]
tipc_release+0x54c/0x10d0 net/tipc/socket.c:648
__sock_release+0xf8/0x1d4 net/socket.c:735
sock_release+0x24/0x34 net/socket.c:763
tipc_topsrv_stop net/tipc/topsrv.c:770 [inline]
tipc_topsrv_exit_net+0x224/0x26c net/tipc/topsrv.c:782
ops_exit_list net/core/net_namespace.c:200 [inline]
ops_undo_list+0x3cc/0x81c net/core/net_namespace.c:253
cleanup_net+0x474/0x6c4 net/core/net_namespace.c:708
process_one_work kernel/workqueue.c:3495 [inline]
process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3578
worker_thread+0x798/0xbd0 kernel/workqueue.c:3659
kthread+0x304/0x3d4 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x179838
flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000000 fffffdffc4e60e08 fffffdffc4e60e08 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff000139838900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff000139838980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff000139838a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff000139838a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff000139838b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
hsr_slave_0: left promiscuous mode
hsr_slave_1: left promiscuous mode
batman_adv: batadv0: Interface deactivated: batadv_slave_0
batman_adv: batadv0: Removing interface: batadv_slave_0
batman_adv: batadv0: Interface deactivated: batadv_slave_1
batman_adv: batadv0: Removing interface: batadv_slave_1
veth1_macvtap: left promiscuous mode
veth0_macvtap: left promiscuous mode
veth1_vlan: left promiscuous mode
veth0_vlan: left promiscuous mode
team0 (unregistering): Port device team_slave_1 removed
team0 (unregistering): Port device team_slave_0 removed
netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
bridge0: port 1(bridge_slave_0) entered blocking state
bridge0: port 1(bridge_slave_0) entered forwarding state
bridge0: port 2(bridge_slave_1) entered blocking state
bridge0: port 2(bridge_slave_1) entered forwarding state
Tested on:
commit: 58c1eb84 arm64: sdei: Preserve the interrupted context..
git tree: https://github.com/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1356e03d580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a58b6b4d667e7a61
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3bf0bd49acd9b21d4b
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
userspace arch: arm64
Note: no patches were applied.
^ permalink raw reply [flat|nested] 10+ messages in thread
[parent not found: <CAO7_G+xNhBX9OmcoLHLA_ygEArCRGEVvX1fHgT5DJpoG26BbJQ@mail.gmail.com>]
[parent not found: <CAO7_G+xfNddPzLFwOEK1nm06WbPMH2b_DgFNOHeE50Za0Zr+eQ@mail.gmail.com>]
* Re: [syzbot] [block?] BUG: unable to handle kernel paging request in blk_mq_complete_request_remote
[not found] <CAO7_G+xfNddPzLFwOEK1nm06WbPMH2b_DgFNOHeE50Za0Zr+eQ@mail.gmail.com>
@ 2026-11-11 4:26 ` syzbot
0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2026-11-11 4:26 UTC (permalink / raw)
To: linux-kernel, nenkov2004, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: unable to handle kernel paging request in ip6mr_rule_action
Unable to handle kernel paging request at virtual address dfff800000000005
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
Mem abort info:
ESR = 0x0000000096000005
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x05: level 1 translation fault
Data abort info:
ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0
[dfff800000000005] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1] SMP
Modules linked in:
CPU: 1 UID: 0 PID: 26 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
Workqueue: mld mld_ifc_work
pstate: 03400005 (nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __ip6mr_get_table net/ipv6/ip6mr.c:135 [inline]
pc : ip6mr_rule_action+0x13c/0x240 net/ipv6/ip6mr.c:182
lr : __ip6mr_get_table net/ipv6/ip6mr.c:135 [inline]
lr : ip6mr_rule_action+0x154/0x240 net/ipv6/ip6mr.c:182
sp : ffff80008fb37320
x29: ffff80008fb37320 x28: 0000000000000001 x27: dfff800000000000
x26: ffff80008fb375d3 x25: 1ffff00011f66eb9 x24: ffff0000cef72030
x23: dfff800000000000 x22: 00000000000000fe x21: ffff0000d8361170
x20: 0000000000000000 x19: ffff80008fb37480 x18: ffff80012364b000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 00000000001afe83 x13: 0000000000000009 x12: 0000000000000009
x11: 000000009b598062 x10: 000000000000000f x9 : 0000000000000005
x8 : 0000000000000028 x7 : ffff800084e20308 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000858e5e60
x2 : 0000000000000000 x1 : ffff0000c1b79d80 x0 : 0000000000000000
Call trace:
__ip6mr_get_table net/ipv6/ip6mr.c:135 [inline] (P)
ip6mr_rule_action+0x13c/0x240 net/ipv6/ip6mr.c:182 (P)
fib_rules_lookup+0x624/0xc14 net/core/fib_rules.c:337
ip6mr_fib_lookup+0x11c/0x1c4 net/ipv6/ip6mr.c:154
mroute6_is_socket+0x128/0x234 net/ipv6/ip6mr.c:1705
ip6_finish_output2+0xbe0/0x132c net/ipv6/ip6_output.c:85
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x230/0x618 net/ipv6/ip6_output.c:221
NF_HOOK_COND include/linux/netfilter.h:314 [inline]
ip6_output+0x2d0/0x528 net/ipv6/ip6_output.c:248
dst_output include/net/dst.h:471 [inline]
NF_HOOK+0x14c/0x464 include/linux/netfilter.h:325
mld_sendpack+0x72c/0xd34 net/ipv6/mcast.c:1890
mld_send_cr net/ipv6/mcast.c:2191 [inline]
mld_ifc_work+0x76c/0x9e4 net/ipv6/mcast.c:2739
process_one_work kernel/workqueue.c:3495 [inline]
process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3578
worker_thread+0x798/0xbd0 kernel/workqueue.c:3659
kthread+0x304/0x3d4 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
Code: eb15029f 540002a0 9100a288 d343fd09 (38f76929)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: eb15029f cmp x20, x21
4: 540002a0 b.eq 0x58 // b.none
8: 9100a288 add x8, x20, #0x28
c: d343fd09 lsr x9, x8, #3
* 10: 38f76929 ldrsb w9, [x9, x23] <-- trapping instruction
Tested on:
commit: 58c1eb84 arm64: sdei: Preserve the interrupted context..
git tree: https://github.com/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=15ce04ad580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a58b6b4d667e7a61
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3bf0bd49acd9b21d4b
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=173b3f7f980000
^ permalink raw reply [flat|nested] 10+ messages in thread
[parent not found: <CAO7_G+w-YoXKa7uTPZgu8JK=zvVOigzOjewNu=kZMZvGTxh8Jw@mail.gmail.com>]
[parent not found: <CAO7_G+y3L5-N_-01cHPEbyvEob5mwgDCN2JgEHJoALzcptMX8A@mail.gmail.com>]
[parent not found: <CAO7_G+wHdgLNKCbCGypfCUbp23eB+fdp-OmFRkn6WNnRTCfTkg@mail.gmail.com>]
* Re: [syzbot] [block?] BUG: unable to handle kernel paging request in blk_mq_complete_request_remote
[not found] <CAO7_G+wHdgLNKCbCGypfCUbp23eB+fdp-OmFRkn6WNnRTCfTkg@mail.gmail.com>
@ 2026-11-10 21:49 ` syzbot
2026-11-11 1:13 ` Hristos Nenkov
0 siblings, 1 reply; 10+ messages in thread
From: syzbot @ 2026-11-10 21:49 UTC (permalink / raw)
To: linux-kernel, nenkov2004, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: null-ptr-deref Write in fib_insert_alias
==================================================================
BUG: KASAN: null-ptr-deref in hlist_add_before_rcu include/linux/rculist.h:744 [inline]
BUG: KASAN: null-ptr-deref in fib_insert_alias+0xb0/0xb08 net/ipv4/fib_trie.c:1160
Write of size 8 at addr 0000000000000000 by task syz-executor/5244
CPU: 1 UID: 0 PID: 5244 Comm: syz-executor Not tainted syzkaller #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
__dump_stack+0x30/0x40 lib/dump_stack.c:94
dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
print_report+0x58/0x84 mm/kasan/report.c:485
kasan_report+0x8c/0xc4 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x17c/0x1ac mm/kasan/generic.c:200
__kasan_check_write+0x20/0x30 mm/kasan/shadow.c:37
hlist_add_before_rcu include/linux/rculist.h:744 [inline]
fib_insert_alias+0xb0/0xb08 net/ipv4/fib_trie.c:1160
fib_table_insert+0x5dc/0x12bc net/ipv4/fib_trie.c:1352
fib_magic+0x26c/0x344 net/ipv4/fib_frontend.c:1147
fib_add_ifaddr+0x2e0/0x500 net/ipv4/fib_frontend.c:1184
fib_netdev_event+0x35c/0x49c net/ipv4/fib_frontend.c:1529
notifier_call_chain+0x1a4/0x4cc kernel/notifier.c:86
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:558
call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2313
call_netdevice_notifiers_extack net/core/dev.c:2351 [inline]
call_netdevice_notifiers net/core/dev.c:2365 [inline]
__dev_notify_flags+0x288/0x438 net/core/dev.c:10051
netif_change_flags+0xd0/0x15c net/core/dev.c:10080
do_setlink+0xc28/0x32d4 net/core/rtnetlink.c:3294
rtnl_changelink net/core/rtnetlink.c:3942 [inline]
__rtnl_newlink net/core/rtnetlink.c:4113 [inline]
rtnl_newlink+0xf48/0x1390 net/core/rtnetlink.c:4252
rtnetlink_rcv_msg+0x66c/0x9bc net/core/rtnetlink.c:7169
netlink_rcv_skb+0x238/0x414 net/netlink/af_netlink.c:2584
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7196
netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
netlink_unicast+0x73c/0x934 net/netlink/af_netlink.c:1361
netlink_sendmsg+0x670/0x98c net/netlink/af_netlink.c:1920
sock_sendmsg_nosec net/socket.c:800 [inline]
__sock_sendmsg+0xc8/0x188 net/socket.c:818
__sys_sendto+0x250/0x328 net/socket.c:2283
__do_sys_sendto net/socket.c:2290 [inline]
__se_sys_sendto net/socket.c:2286 [inline]
__arm64_sys_sendto+0xec/0x10c net/socket.c:2286
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
==================================================================
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Mem abort info:
ESR = 0x0000000096000044
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000044, ISS2 = 0x00000000
CM = 0, WnR = 1, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=00000001173dd000
[0000000000000000] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000044 [#1] SMP
Modules linked in:
CPU: 1 UID: 0 PID: 5244 Comm: syz-executor Tainted: G B syzkaller #0 PREEMPT
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : hlist_add_before_rcu include/linux/rculist.h:744 [inline]
pc : fib_insert_alias+0xb0/0xb08 net/ipv4/fib_trie.c:1160
lr : hlist_add_before_rcu include/linux/rculist.h:744 [inline]
lr : fib_insert_alias+0xb0/0xb08 net/ipv4/fib_trie.c:1160
sp : ffff800096b86750
x29: ffff800096b86780 x28: ffff0000c8fb8528 x27: ffff0000eb35fc20
x26: dfff800000000000 x25: 0000000000000018 x24: ffff0000c8fb8210
x23: ffff0000dcc87660 x22: 0000000000000000 x21: ffff0000c8fb8528
x20: ffff0000c8fb8218 x19: 1fffe000191f7043 x18: 0000000000000000
x17: 3d3d3d3d3d3d3d3d x16: 3d3d3d3d3d3d3d3d x15: 3d3d3d3d3d3d3d3d
x14: 00000000000006f9 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff70001161f92d x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000000 x6 : ffff8000804a0c38
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030c9a8
x2 : 0000000000000000 x1 : ffff0000c1fb1d80 x0 : 0000000000000000
Call trace:
hlist_add_before_rcu include/linux/rculist.h:744 [inline] (P)
fib_insert_alias+0xb0/0xb08 net/ipv4/fib_trie.c:1160 (P)
fib_table_insert+0x5dc/0x12bc net/ipv4/fib_trie.c:1352
fib_magic+0x26c/0x344 net/ipv4/fib_frontend.c:1147
fib_add_ifaddr+0x2e0/0x500 net/ipv4/fib_frontend.c:1184
fib_netdev_event+0x35c/0x49c net/ipv4/fib_frontend.c:1529
notifier_call_chain+0x1a4/0x4cc kernel/notifier.c:86
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:558
call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2313
call_netdevice_notifiers_extack net/core/dev.c:2351 [inline]
call_netdevice_notifiers net/core/dev.c:2365 [inline]
__dev_notify_flags+0x288/0x438 net/core/dev.c:10051
netif_change_flags+0xd0/0x15c net/core/dev.c:10080
do_setlink+0xc28/0x32d4 net/core/rtnetlink.c:3294
rtnl_changelink net/core/rtnetlink.c:3942 [inline]
__rtnl_newlink net/core/rtnetlink.c:4113 [inline]
rtnl_newlink+0xf48/0x1390 net/core/rtnetlink.c:4252
rtnetlink_rcv_msg+0x66c/0x9bc net/core/rtnetlink.c:7169
netlink_rcv_skb+0x238/0x414 net/netlink/af_netlink.c:2584
rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7196
netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
netlink_unicast+0x73c/0x934 net/netlink/af_netlink.c:1361
netlink_sendmsg+0x670/0x98c net/netlink/af_netlink.c:1920
sock_sendmsg_nosec net/socket.c:800 [inline]
__sock_sendmsg+0xc8/0x188 net/socket.c:818
__sys_sendto+0x250/0x328 net/socket.c:2283
__do_sys_sendto net/socket.c:2290 [inline]
__se_sys_sendto net/socket.c:2286 [inline]
__arm64_sys_sendto+0xec/0x10c net/socket.c:2286
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
Code: aa1603e0 52800101 f90002b8 96d8b07a (c89ffed5)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: aa1603e0 mov x0, x22
4: 52800101 mov w1, #0x8 // #8
8: f90002b8 str x24, [x21]
c: 96d8b07a bl 0xfffffffffb62c1f4
* 10: c89ffed5 stlr x21, [x22] <-- trapping instruction
Tested on:
commit: 067c5c24 Merge tag 'page_alloc-for-7.4-rc2' of git://g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12c7b1fd580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c06331d9bb9c8204
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3bf0bd49acd9b21d4b
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=16dccebe580000
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [syzbot] [block?] BUG: unable to handle kernel paging request in blk_mq_complete_request_remote
2026-11-10 21:49 ` syzbot
@ 2026-11-11 1:13 ` Hristos Nenkov
0 siblings, 0 replies; 10+ messages in thread
From: Hristos Nenkov @ 2026-11-11 1:13 UTC (permalink / raw)
To: syzbot+2e3bf0bd49acd9b21d4b; +Cc: syzkaller-bugs, linux-kernel
#syz invalid
I traced the current C reproducer and this report is induced by privileged
userspace directly manipulating the live NVMe PCI BAR rather than by a normal
NVMe request lifecycle.
The reproducer mounts sysfs, opens
/sys/bus/pci/devices/0000:00:02.0/resource0 with O_RDWR, and mmaps 0x2000
bytes with PROT_READ|PROT_WRITE. It then uses addresses inside that mapping
as process memory while operating on /proc/self/cmdline. In particular,
0x20002000 is BAR offset 0x1000, i.e. the NVMe doorbell area for this mapping.
The test therefore allows userspace-controlled accesses to an active
controller's MMIO registers and can make the device produce CQEs that do not
correspond to the driver's normal submission lifecycle.
The reproducer is privileged: its sandbox only drops CAP_SYS_PTRACE and
CAP_SYS_NICE, and the syzbot security assessment also marks this as
PeripheralTrigger/VMHostTrigger, not Unprivileged or UserNamespace.
A driver-side "request must be IN_FLIGHT" filter is not a sound fix here:
after tag/CID reuse a stale CQE can race with a newly started request and become
indistinguishable from a legitimate completion, turning a crash into potential
silent data corruption. Making the NVMe BAR exclusive is also not an
appropriate NVMe fix because userspace register mapping is an intentional
interface used by tools such as nvme-cli show-regs when strict I/O-memory
access is disabled.
I also submitted separate syzbot diagnostics for the existing genctr-on-cancel
and controller-disable proposals, plus an exclusive-BAR diagnostic. Those are
useful for their respective real late-completion/error-path cases, but they do
not make privileged arbitrary live-controller MMIO a valid NVMe software
lifecycle.
This report should therefore be treated as a one-off invalid crash induced by
direct privileged hardware/MMIO manipulation.
On Tue, 10 Nov 2026 13:49:04 -0800, syzbot
<syzbot+2e3bf0bd49acd9b21d4b@syzkaller.appspotmail.com> wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> KASAN: null-ptr-deref Write in fib_insert_alias
>
> ==================================================================
> BUG: KASAN: null-ptr-deref in hlist_add_before_rcu include/linux/rculist.h:744 [inline]
> BUG: KASAN: null-ptr-deref in fib_insert_alias+0xb0/0xb08 net/ipv4/fib_trie.c:1160
> Write of size 8 at addr 0000000000000000 by task syz-executor/5244
>
> CPU: 1 UID: 0 PID: 5244 Comm: syz-executor Not tainted syzkaller #0 PREEMPT
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
> Call trace:
> show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
> __dump_stack+0x30/0x40 lib/dump_stack.c:94
> dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
> print_report+0x58/0x84 mm/kasan/report.c:485
> kasan_report+0x8c/0xc4 mm/kasan/report.c:595
> check_region_inline mm/kasan/generic.c:-1 [inline]
> kasan_check_range+0x17c/0x1ac mm/kasan/generic.c:200
> __kasan_check_write+0x20/0x30 mm/kasan/shadow.c:37
> hlist_add_before_rcu include/linux/rculist.h:744 [inline]
> fib_insert_alias+0xb0/0xb08 net/ipv4/fib_trie.c:1160
> fib_table_insert+0x5dc/0x12bc net/ipv4/fib_trie.c:1352
> fib_magic+0x26c/0x344 net/ipv4/fib_frontend.c:1147
> fib_add_ifaddr+0x2e0/0x500 net/ipv4/fib_frontend.c:1184
> fib_netdev_event+0x35c/0x49c net/ipv4/fib_frontend.c:1529
> notifier_call_chain+0x1a4/0x4cc kernel/notifier.c:86
> raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:558
> call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2313
> call_netdevice_notifiers_extack net/core/dev.c:2351 [inline]
> call_netdevice_notifiers net/core/dev.c:2365 [inline]
> __dev_notify_flags+0x288/0x438 net/core/dev.c:10051
> netif_change_flags+0xd0/0x15c net/core/dev.c:10080
> do_setlink+0xc28/0x32d4 net/core/rtnetlink.c:3294
> rtnl_changelink net/core/rtnetlink.c:3942 [inline]
> __rtnl_newlink net/core/rtnetlink.c:4113 [inline]
> rtnl_newlink+0xf48/0x1390 net/core/rtnetlink.c:4252
> rtnetlink_rcv_msg+0x66c/0x9bc net/core/rtnetlink.c:7169
> netlink_rcv_skb+0x238/0x414 net/netlink/af_netlink.c:2584
> rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7196
> netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
> netlink_unicast+0x73c/0x934 net/netlink/af_netlink.c:1361
> netlink_sendmsg+0x670/0x98c net/netlink/af_netlink.c:1920
> sock_sendmsg_nosec net/socket.c:800 [inline]
> __sock_sendmsg+0xc8/0x188 net/socket.c:818
> __sys_sendto+0x250/0x328 net/socket.c:2283
> __do_sys_sendto net/socket.c:2290 [inline]
> __se_sys_sendto net/socket.c:2286 [inline]
> __arm64_sys_sendto+0xec/0x10c net/socket.c:2286
> __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
> invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
> el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
> do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
> el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
> el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
> el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
> ==================================================================
> Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
> Mem abort info:
> ESR = 0x0000000096000044
> EC = 0x25: DABT (current EL), IL = 32 bits
> SET = 0, FnV = 0
> EA = 0, S1PTW = 0
> FSC = 0x04: level 0 translation fault
> Data abort info:
> ISV = 0, ISS = 0x00000044, ISS2 = 0x00000000
> CM = 0, WnR = 1, TnD = 0, TagAccess = 0
> GCS = 0, Overlay = 0, DirtyBit = 0
> user pgtable: 4k pages, 48-bit VAs, pgdp=00000001173dd000
> [0000000000000000] pgd=0000000000000000, p4d=0000000000000000
> Internal error: Oops: 0000000096000044 [#1] SMP
> Modules linked in:
> CPU: 1 UID: 0 PID: 5244 Comm: syz-executor Tainted: G B syzkaller #0 PREEMPT
> Tainted: [B]=BAD_PAGE
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
> pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
> pc : hlist_add_before_rcu include/linux/rculist.h:744 [inline]
> pc : fib_insert_alias+0xb0/0xb08 net/ipv4/fib_trie.c:1160
> lr : hlist_add_before_rcu include/linux/rculist.h:744 [inline]
> lr : fib_insert_alias+0xb0/0xb08 net/ipv4/fib_trie.c:1160
> sp : ffff800096b86750
> x29: ffff800096b86780 x28: ffff0000c8fb8528 x27: ffff0000eb35fc20
> x26: dfff800000000000 x25: 0000000000000018 x24: ffff0000c8fb8210
> x23: ffff0000dcc87660 x22: 0000000000000000 x21: ffff0000c8fb8528
> x20: ffff0000c8fb8218 x19: 1fffe000191f7043 x18: 0000000000000000
> x17: 3d3d3d3d3d3d3d3d x16: 3d3d3d3d3d3d3d3d x15: 3d3d3d3d3d3d3d3d
> x14: 00000000000006f9 x13: 0000000000000001 x12: 0000000000000000
> x11: 0000000000000000 x10: ffff70001161f92d x9 : 0000000000000000
> x8 : 0000000000000000 x7 : 0000000000000000 x6 : ffff8000804a0c38
> x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008030c9a8
> x2 : 0000000000000000 x1 : ffff0000c1fb1d80 x0 : 0000000000000000
> Call trace:
> hlist_add_before_rcu include/linux/rculist.h:744 [inline] (P)
> fib_insert_alias+0xb0/0xb08 net/ipv4/fib_trie.c:1160 (P)
> fib_table_insert+0x5dc/0x12bc net/ipv4/fib_trie.c:1352
> fib_magic+0x26c/0x344 net/ipv4/fib_frontend.c:1147
> fib_add_ifaddr+0x2e0/0x500 net/ipv4/fib_frontend.c:1184
> fib_netdev_event+0x35c/0x49c net/ipv4/fib_frontend.c:1529
> notifier_call_chain+0x1a4/0x4cc kernel/notifier.c:86
> raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:558
> call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2313
> call_netdevice_notifiers_extack net/core/dev.c:2351 [inline]
> call_netdevice_notifiers net/core/dev.c:2365 [inline]
> __dev_notify_flags+0x288/0x438 net/core/dev.c:10051
> netif_change_flags+0xd0/0x15c net/core/dev.c:10080
> do_setlink+0xc28/0x32d4 net/core/rtnetlink.c:3294
> rtnl_changelink net/core/rtnetlink.c:3942 [inline]
> __rtnl_newlink net/core/rtnetlink.c:4113 [inline]
> rtnl_newlink+0xf48/0x1390 net/core/rtnetlink.c:4252
> rtnetlink_rcv_msg+0x66c/0x9bc net/core/rtnetlink.c:7169
> netlink_rcv_skb+0x238/0x414 net/netlink/af_netlink.c:2584
> rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7196
> netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
> netlink_unicast+0x73c/0x934 net/netlink/af_netlink.c:1361
> netlink_sendmsg+0x670/0x98c net/netlink/af_netlink.c:1920
> sock_sendmsg_nosec net/socket.c:800 [inline]
> __sock_sendmsg+0xc8/0x188 net/socket.c:818
> __sys_sendto+0x250/0x328 net/socket.c:2283
> __do_sys_sendto net/socket.c:2290 [inline]
> __se_sys_sendto net/socket.c:2286 [inline]
> __arm64_sys_sendto+0xec/0x10c net/socket.c:2286
> __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
> invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
> el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
> do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
> el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797
> el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816
> el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
> Code: aa1603e0 52800101 f90002b8 96d8b07a (c89ffed5)
> ---[ end trace 0000000000000000 ]---
> ----------------
> Code disassembly (best guess):
> 0: aa1603e0 mov x0, x22
> 4: 52800101 mov w1, #0x8 // #8
> 8: f90002b8 str x24, [x21]
> c: 96d8b07a bl 0xfffffffffb62c1f4
> * 10: c89ffed5 stlr x21, [x22] <-- trapping instruction
>
> Tested on:
>
> commit: 067c5c24 Merge tag 'page_alloc-for-7.4-rc2' of git://g..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=12c7b1fd580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=c06331d9bb9c8204
> dashboard link: https://syzkaller.appspot.com/bug?extid=2e3bf0bd49acd9b21d4b
> compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
> userspace arch: arm64
> patch: https://syzkaller.appspot.com/x/patch.diff?x=16dccebe580000
^ permalink raw reply [flat|nested] 10+ messages in thread
* [syzbot] [block?] BUG: unable to handle kernel paging request in blk_mq_complete_request_remote
@ 2026-08-27 10:07 syzbot
2026-10-07 11:18 ` syzbot
0 siblings, 1 reply; 10+ messages in thread
From: syzbot @ 2026-08-27 10:07 UTC (permalink / raw)
To: axboe, linux-block, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 68f892e99df9 Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=135bb415580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d1128bc53f2ef7f3
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3bf0bd49acd9b21d4b
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f98dd20a7b98/disk-68f892e9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/441f1ad32549/vmlinux-68f892e9.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8da5227b7dc8/Image-68f892e9.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2e3bf0bd49acd9b21d4b@syzkaller.appspotmail.com
Unable to handle kernel paging request at virtual address dfff800000000031
KASAN: null-ptr-deref in range [0x0000000000000188-0x000000000000018f]
Mem abort info:
ESR = 0x0000000096000005
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x05: level 1 translation fault
Data abort info:
ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0
[dfff800000000031] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1] SMP
Modules linked in:
CPU: 1 UID: 0 PID: 8684 Comm: kworker/u8:27 Tainted: G L syzkaller #0 PREEMPT
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Workqueue: nvme-reset-wq nvme_reset_work
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : blk_mq_complete_request_remote+0xc4/0x858 block/blk-mq.c:1297
lr : blk_mq_complete_request_remote+0x88/0x858 block/blk-mq.c:1289
sp : ffff800095647900
x29: ffff800095647980 x28: ffff800095647900 x27: dfff800000000000
x26: 0000000000000000 x25: ffff0000c648326a x24: dfff800000000000
x23: ffff700012ac8f20 x22: 1fffe000192284a4 x21: 1fffe00018c90648
x20: 000000000000018e x19: ffff0000c9142400 x18: 1fffe00034bbbe28
x17: 0000000000000003 x16: ffff800088b37000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000004
x11: ffff700012ac8f3c x10: ffff8000884bb5d7 x9 : 1fffe00019228482
x8 : 0000000000000031 x7 : ffff80008281b4e0 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff80008281f228
x2 : 0000000000000000 x1 : ffff0000d604ba80 x0 : 0000000000000000
Call trace:
blk_mq_complete_request_remote+0xc4/0x858 block/blk-mq.c:1297 (P)
nvme_try_complete_req drivers/nvme/host/nvme.h:823 [inline]
nvme_handle_cqe drivers/nvme/host/pci.c:1590 [inline]
nvme_poll_cq+0x4ec/0x106c drivers/nvme/host/pci.c:1621
nvme_reap_pending_cqes drivers/nvme/host/pci.c:2078 [inline]
nvme_dev_disable+0x384/0x540 drivers/nvme/host/pci.c:3328
nvme_reset_work+0x510/0x69c drivers/nvme/host/pci.c:3490
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3405
worker_thread+0x798/0xbd0 kernel/workqueue.c:3486
kthread+0x304/0x3d4 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838
Code: 97d02797 f9400288 91063914 d343fe88 (38f86908)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: 97d02797 bl 0xffffffffff409e5c
4: f9400288 ldr x8, [x20]
8: 91063914 add x20, x8, #0x18e
c: d343fe88 lsr x8, x20, #3
* 10: 38f86908 ldrsb w8, [x8, x24] <-- trapping instruction
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [block?] BUG: unable to handle kernel paging request in blk_mq_complete_request_remote
2026-08-27 10:07 syzbot
@ 2026-10-07 11:18 ` syzbot
0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2026-10-07 11:18 UTC (permalink / raw)
To: axboe, linux-block, linux-kernel, syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: 71c3e5409eef Merge remote-tracking branch 'will/for-next/p..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=13c9400d580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c7205f05c11fb4dd
dashboard link: https://syzkaller.appspot.com/bug?extid=2e3bf0bd49acd9b21d4b
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17c9400d580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14fa21c9580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/20ff6159ce99/disk-71c3e540.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1d6172672705/vmlinux-71c3e540.xz
kernel image: https://storage.googleapis.com/syzbot-assets/923d5e083e1b/Image-71c3e540.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2e3bf0bd49acd9b21d4b@syzkaller.appspotmail.com
Unable to handle kernel paging request at virtual address dfff800000000031
KASAN: null-ptr-deref in range [0x0000000000000188-0x000000000000018f]
Mem abort info:
ESR = 0x0000000096000005
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x05: level 1 translation fault
Data abort info:
ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0
[dfff800000000031] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1] SMP
Modules linked in:
CPU: 0 UID: 0 PID: 41 Comm: pr/ttyAMA-1 Not tainted syzkaller #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 034000c5 (nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : blk_mq_complete_request_remote+0xc4/0x858 block/blk-mq.c:1310
lr : blk_mq_complete_request_remote+0x88/0x858 block/blk-mq.c:1302
sp : ffff80008eac7ba0
x29: ffff80008eac7c30 x28: ffff80008eac7ba0 x27: 1fffe000190b201c
x26: 0000000000000001 x25: ffff0000c85900ee x24: dfff800000000000
x23: ffff700011d58f74 x22: 1fffe000190c0f24 x21: ffff0000c8607924
x20: 000000000000018e x19: ffff0000c8607800 x18: ffff800125472000
x17: ffff800125472000 x16: ffff80008eac0000 x15: 0000000000000000
x14: 00000000001afe2f x13: 0000000000000005 x12: 0000000000000000
x11: ffff80008eac7d98 x10: ffff8000883f0335 x9 : 1fffe000190c0f02
x8 : 0000000000000031 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffff8000827e349c
x2 : 0000000000000000 x1 : ffff0000c24b9d80 x0 : 0000000000000000
Call trace:
blk_mq_complete_request_remote+0xc4/0x858 block/blk-mq.c:1310 (P)
nvme_try_complete_req drivers/nvme/host/nvme.h:839 [inline]
nvme_handle_cqe drivers/nvme/host/pci.c:1601 [inline]
nvme_poll_cq+0x544/0xfd8 drivers/nvme/host/pci.c:1632
nvme_irq+0x9c/0x120 drivers/nvme/host/pci.c:1646
__handle_irq_event_percpu+0x200/0x8ac kernel/irq/handle.c:209
handle_irq_event_percpu+0x2c/0xd8 kernel/irq/handle.c:246
handle_irq_event+0x98/0x188 kernel/irq/handle.c:263
handle_fasteoi_irq+0x328/0x864 kernel/irq/chip.c:768
generic_handle_irq_desc include/linux/irqdesc.h:188 [inline]
handle_irq_desc kernel/irq/irqdesc.c:679 [inline]
generic_handle_domain_irq+0xe4/0x154 kernel/irq/irqdesc.c:735
__gic_handle_irq drivers/irqchip/irq-gic-v3.c:825 [inline]
__gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:873 [inline]
gic_handle_irq+0x6c/0x180 drivers/irqchip/irq-gic-v3.c:917
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901
do_interrupt_handler+0xd4/0x138 arch/arm64/kernel/entry-common.c:216
__el1_irq arch/arm64/kernel/entry-common.c:568 [inline]
el1_interrupt+0x3c/0x60 arch/arm64/kernel/entry-common.c:581
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586
el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602
__daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P)
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P)
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] (P)
_raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:221 (P)
spin_unlock_irqrestore include/linux/spinlock.h:425 [inline]
__uart_port_unlock_irqrestore include/linux/serial_core.h:622 [inline]
pl011_console_device_unlock+0x94/0xcc drivers/tty/serial/amba-pl011.c:2721
nbcon_emit_one+0x160/0x1e4 kernel/printk/nbcon.c:1165
nbcon_kthread_func+0x56c/0x6c0 kernel/printk/nbcon.c:1271
kthread+0x304/0x3d4 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
Code: 97d041fa f9400288 91063914 d343fe88 (38f86908)
---[ end trace 0000000000000000 ]---
Calling EFI runtime from hardirq context
------------[ cut here ]------------
WARNING: arch/arm64/kernel/traps.c:414 at force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414, CPU#0: pr/ttyAMA-1/41
Modules linked in:
CPU: 0 UID: 0 PID: 41 Comm: pr/ttyAMA-1 Tainted: G D syzkaller #0 PREEMPT
Tainted: [D]=DIE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 034000c5 (nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
lr : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
sp : ffff80008eac71c0
x29: ffff80008eac71c0 x28: ffff80008eac74c0 x27: dfff800000000000
x26: 0000000000000000 x25: ffff80008efe0000 x24: dfff800000000000
x23: 0000000000000005 x22: 0000000000000009 x21: 0000000000000080
x20: 0000000000000000 x19: 0000000000000000 x18: 00000000ffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000881 x13: 0000000000000001 x12: 0000000000000003
x11: 0000000000000001 x10: 0000000001000005 x9 : 0000000001000004
x8 : ffff0000c24b9d80 x7 : 0000000000000001 x6 : ffff800080482944
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000801524f4
x2 : 0000000000000005 x1 : ffff0000c24b9d80 x0 : 0000000000000000
Call trace:
force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414 (P)
__efi_fpsimd_begin+0xd8/0x21c arch/arm64/kernel/fpsimd.c:2010
arch_efi_call_virt_setup+0xb4/0x254 arch/arm64/kernel/efi.c:187
virt_efi_set_variable_nb+0x9c/0x110 drivers/firmware/efi/runtime-wrappers.c:492
efivar_set_variable_locked+0x1cc/0x208 drivers/firmware/efi/vars.c:231
efi_pstore_write+0x2d4/0x418 drivers/firmware/efi/efi-pstore.c:227
pstore_dump+0x57c/0x8e8 fs/pstore/platform.c:355
kmsg_dump_desc+0x1f4/0x328 kernel/printk/printk.c:4880
kmsg_dump include/linux/kmsg_dump.h:123 [inline]
oops_exit+0x34/0x40 kernel/panic.c:1066
die+0xb8/0x1d4 arch/arm64/kernel/traps.c:224
die_kernel_fault+0x6c/0x80 arch/arm64/mm/fault.c:358
__do_kernel_fault+0x55c/0x590 arch/arm64/mm/fault.c:458
do_bad_area+0x7c/0x148 arch/arm64/mm/fault.c:533
do_translation_fault+0xdc/0x114 arch/arm64/mm/fault.c:851
do_mem_abort+0x70/0x194 arch/arm64/mm/fault.c:1012
el1_abort+0x50/0x74 arch/arm64/kernel/entry-common.c:380
el1h_64_sync_handler+0xdc/0x130 arch/arm64/kernel/entry-common.c:507
el1h_64_sync+0x78/0x7c arch/arm64/kernel/entry.S:601
blk_mq_complete_request_remote+0xc4/0x858 block/blk-mq.c:1310 (P)
nvme_try_complete_req drivers/nvme/host/nvme.h:839 [inline]
nvme_handle_cqe drivers/nvme/host/pci.c:1601 [inline]
nvme_poll_cq+0x544/0xfd8 drivers/nvme/host/pci.c:1632
nvme_irq+0x9c/0x120 drivers/nvme/host/pci.c:1646
__handle_irq_event_percpu+0x200/0x8ac kernel/irq/handle.c:209
handle_irq_event_percpu+0x2c/0xd8 kernel/irq/handle.c:246
handle_irq_event+0x98/0x188 kernel/irq/handle.c:263
handle_fasteoi_irq+0x328/0x864 kernel/irq/chip.c:768
generic_handle_irq_desc include/linux/irqdesc.h:188 [inline]
handle_irq_desc kernel/irq/irqdesc.c:679 [inline]
generic_handle_domain_irq+0xe4/0x154 kernel/irq/irqdesc.c:735
__gic_handle_irq drivers/irqchip/irq-gic-v3.c:825 [inline]
__gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:873 [inline]
gic_handle_irq+0x6c/0x180 drivers/irqchip/irq-gic-v3.c:917
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901
do_interrupt_handler+0xd4/0x138 arch/arm64/kernel/entry-common.c:216
__el1_irq arch/arm64/kernel/entry-common.c:568 [inline]
el1_interrupt+0x3c/0x60 arch/arm64/kernel/entry-common.c:581
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586
el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602
__daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P)
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P)
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] (P)
_raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:221 (P)
spin_unlock_irqrestore include/linux/spinlock.h:425 [inline]
__uart_port_unlock_irqrestore include/linux/serial_core.h:622 [inline]
pl011_console_device_unlock+0x94/0xcc drivers/tty/serial/amba-pl011.c:2721
nbcon_emit_one+0x160/0x1e4 kernel/printk/nbcon.c:1165
nbcon_kthread_func+0x56c/0x6c0 kernel/printk/nbcon.c:1271
kthread+0x304/0x3d4 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
irq event stamp: 19610
hardirqs last enabled at (19609): [<ffff80008688fdec>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline]
hardirqs last enabled at (19609): [<ffff80008688fdec>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221
hardirqs last disabled at (19610): [<ffff80008686ba58>] __el1_irq arch/arm64/kernel/entry-common.c:565 [inline]
hardirqs last disabled at (19610): [<ffff80008686ba58>] el1_interrupt+0x28/0x60 arch/arm64/kernel/entry-common.c:581
softirqs last enabled at (19568): [<ffff80008030a6dc>] softirq_handle_end kernel/softirq.c:491 [inline]
softirqs last enabled at (19568): [<ffff80008030a6dc>] handle_softirqs+0xb2c/0xcbc kernel/softirq.c:673
softirqs last disabled at (19425): [<ffff8000800203f0>] __do_softirq+0x14/0x20 kernel/softirq.c:679
---[ end trace 0000000000000000 ]---
Calling EFI runtime from hardirq context
------------[ cut here ]------------
WARNING: arch/arm64/kernel/traps.c:414 at force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414, CPU#0: pr/ttyAMA-1/41
Modules linked in:
CPU: 0 UID: 0 PID: 41 Comm: pr/ttyAMA-1 Tainted: G D W syzkaller #0 PREEMPT
Tainted: [D]=DIE, [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 034000c5 (nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
lr : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
sp : ffff80008eac71c0
x29: ffff80008eac71c0 x28: ffff80008eac74c0 x27: dfff800000000000
x26: 0000000000000000 x25: ffff80008efe0000 x24: dfff800000000000
x23: 0000000000000005 x22: 0000000000000009 x21: 0000000000000080
x20: 0000000000000000 x19: 0000000000000000 x18: 00000000ffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 00000000000008e3 x13: 0000000000000001 x12: 0000000000000003
x11: 0000000000000001 x10: 0000000001000005 x9 : 0000000001000004
x8 : ffff0000c24b9d80 x7 : 0000000000000001 x6 : ffff800080482944
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000801524f4
x2 : 0000000000000005 x1 : ffff0000c24b9d80 x0 : 0000000000000000
Call trace:
force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414 (P)
__efi_fpsimd_begin+0xd8/0x21c arch/arm64/kernel/fpsimd.c:2010
arch_efi_call_virt_setup+0xb4/0x254 arch/arm64/kernel/efi.c:187
virt_efi_set_variable_nb+0x9c/0x110 drivers/firmware/efi/runtime-wrappers.c:492
efivar_set_variable_locked+0x1cc/0x208 drivers/firmware/efi/vars.c:231
efi_pstore_write+0x2d4/0x418 drivers/firmware/efi/efi-pstore.c:227
pstore_dump+0x57c/0x8e8 fs/pstore/platform.c:355
kmsg_dump_desc+0x1f4/0x328 kernel/printk/printk.c:4880
kmsg_dump include/linux/kmsg_dump.h:123 [inline]
oops_exit+0x34/0x40 kernel/panic.c:1066
die+0xb8/0x1d4 arch/arm64/kernel/traps.c:224
die_kernel_fault+0x6c/0x80 arch/arm64/mm/fault.c:358
__do_kernel_fault+0x55c/0x590 arch/arm64/mm/fault.c:458
do_bad_area+0x7c/0x148 arch/arm64/mm/fault.c:533
do_translation_fault+0xdc/0x114 arch/arm64/mm/fault.c:851
do_mem_abort+0x70/0x194 arch/arm64/mm/fault.c:1012
el1_abort+0x50/0x74 arch/arm64/kernel/entry-common.c:380
el1h_64_sync_handler+0xdc/0x130 arch/arm64/kernel/entry-common.c:507
el1h_64_sync+0x78/0x7c arch/arm64/kernel/entry.S:601
blk_mq_complete_request_remote+0xc4/0x858 block/blk-mq.c:1310 (P)
nvme_try_complete_req drivers/nvme/host/nvme.h:839 [inline]
nvme_handle_cqe drivers/nvme/host/pci.c:1601 [inline]
nvme_poll_cq+0x544/0xfd8 drivers/nvme/host/pci.c:1632
nvme_irq+0x9c/0x120 drivers/nvme/host/pci.c:1646
__handle_irq_event_percpu+0x200/0x8ac kernel/irq/handle.c:209
handle_irq_event_percpu+0x2c/0xd8 kernel/irq/handle.c:246
handle_irq_event+0x98/0x188 kernel/irq/handle.c:263
handle_fasteoi_irq+0x328/0x864 kernel/irq/chip.c:768
generic_handle_irq_desc include/linux/irqdesc.h:188 [inline]
handle_irq_desc kernel/irq/irqdesc.c:679 [inline]
generic_handle_domain_irq+0xe4/0x154 kernel/irq/irqdesc.c:735
__gic_handle_irq drivers/irqchip/irq-gic-v3.c:825 [inline]
__gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:873 [inline]
gic_handle_irq+0x6c/0x180 drivers/irqchip/irq-gic-v3.c:917
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901
do_interrupt_handler+0xd4/0x138 arch/arm64/kernel/entry-common.c:216
__el1_irq arch/arm64/kernel/entry-common.c:568 [inline]
el1_interrupt+0x3c/0x60 arch/arm64/kernel/entry-common.c:581
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586
el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602
__daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P)
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P)
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] (P)
_raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:221 (P)
spin_unlock_irqrestore include/linux/spinlock.h:425 [inline]
__uart_port_unlock_irqrestore include/linux/serial_core.h:622 [inline]
pl011_console_device_unlock+0x94/0xcc drivers/tty/serial/amba-pl011.c:2721
nbcon_emit_one+0x160/0x1e4 kernel/printk/nbcon.c:1165
nbcon_kthread_func+0x56c/0x6c0 kernel/printk/nbcon.c:1271
kthread+0x304/0x3d4 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
irq event stamp: 19610
hardirqs last enabled at (19609): [<ffff80008688fdec>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline]
hardirqs last enabled at (19609): [<ffff80008688fdec>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221
hardirqs last disabled at (19610): [<ffff80008686ba58>] __el1_irq arch/arm64/kernel/entry-common.c:565 [inline]
hardirqs last disabled at (19610): [<ffff80008686ba58>] el1_interrupt+0x28/0x60 arch/arm64/kernel/entry-common.c:581
softirqs last enabled at (19568): [<ffff80008030a6dc>] softirq_handle_end kernel/softirq.c:491 [inline]
softirqs last enabled at (19568): [<ffff80008030a6dc>] handle_softirqs+0xb2c/0xcbc kernel/softirq.c:673
softirqs last disabled at (19425): [<ffff8000800203f0>] __do_softirq+0x14/0x20 kernel/softirq.c:679
---[ end trace 0000000000000000 ]---
Calling EFI runtime from hardirq context
------------[ cut here ]------------
WARNING: arch/arm64/kernel/traps.c:414 at force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414, CPU#0: pr/ttyAMA-1/41
Modules linked in:
CPU: 0 UID: 0 PID: 41 Comm: pr/ttyAMA-1 Tainted: G D W syzkaller #0 PREEMPT
Tainted: [D]=DIE, [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 034000c5 (nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
lr : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
sp : ffff80008eac71c0
x29: ffff80008eac71c0 x28: ffff80008eac74c0 x27: dfff800000000000
x26: 0000000000000000 x25: ffff80008efe0000 x24: dfff800000000000
x23: 0000000000000005 x22: 0000000000000009 x21: 0000000000000080
x20: 0000000000000000 x19: 0000000000000000 x18: 00000000ffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000945 x13: 0000000000000001 x12: 0000000000000003
x11: 0000000000000001 x10: 0000000001000005 x9 : 0000000001000004
x8 : ffff0000c24b9d80 x7 : 0000000000000001 x6 : ffff800080482944
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000801524f4
x2 : 0000000000000005 x1 : ffff0000c24b9d80 x0 : 0000000000000000
Call trace:
force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414 (P)
__efi_fpsimd_begin+0xd8/0x21c arch/arm64/kernel/fpsimd.c:2010
arch_efi_call_virt_setup+0xb4/0x254 arch/arm64/kernel/efi.c:187
virt_efi_set_variable_nb+0x9c/0x110 drivers/firmware/efi/runtime-wrappers.c:492
efivar_set_variable_locked+0x1cc/0x208 drivers/firmware/efi/vars.c:231
efi_pstore_write+0x2d4/0x418 drivers/firmware/efi/efi-pstore.c:227
pstore_dump+0x57c/0x8e8 fs/pstore/platform.c:355
kmsg_dump_desc+0x1f4/0x328 kernel/printk/printk.c:4880
kmsg_dump include/linux/kmsg_dump.h:123 [inline]
oops_exit+0x34/0x40 kernel/panic.c:1066
die+0xb8/0x1d4 arch/arm64/kernel/traps.c:224
die_kernel_fault+0x6c/0x80 arch/arm64/mm/fault.c:358
__do_kernel_fault+0x55c/0x590 arch/arm64/mm/fault.c:458
do_bad_area+0x7c/0x148 arch/arm64/mm/fault.c:533
do_translation_fault+0xdc/0x114 arch/arm64/mm/fault.c:851
do_mem_abort+0x70/0x194 arch/arm64/mm/fault.c:1012
el1_abort+0x50/0x74 arch/arm64/kernel/entry-common.c:380
el1h_64_sync_handler+0xdc/0x130 arch/arm64/kernel/entry-common.c:507
el1h_64_sync+0x78/0x7c arch/arm64/kernel/entry.S:601
blk_mq_complete_request_remote+0xc4/0x858 block/blk-mq.c:1310 (P)
nvme_try_complete_req drivers/nvme/host/nvme.h:839 [inline]
nvme_handle_cqe drivers/nvme/host/pci.c:1601 [inline]
nvme_poll_cq+0x544/0xfd8 drivers/nvme/host/pci.c:1632
nvme_irq+0x9c/0x120 drivers/nvme/host/pci.c:1646
__handle_irq_event_percpu+0x200/0x8ac kernel/irq/handle.c:209
handle_irq_event_percpu+0x2c/0xd8 kernel/irq/handle.c:246
handle_irq_event+0x98/0x188 kernel/irq/handle.c:263
handle_fasteoi_irq+0x328/0x864 kernel/irq/chip.c:768
generic_handle_irq_desc include/linux/irqdesc.h:188 [inline]
handle_irq_desc kernel/irq/irqdesc.c:679 [inline]
generic_handle_domain_irq+0xe4/0x154 kernel/irq/irqdesc.c:735
__gic_handle_irq drivers/irqchip/irq-gic-v3.c:825 [inline]
__gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:873 [inline]
gic_handle_irq+0x6c/0x180 drivers/irqchip/irq-gic-v3.c:917
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901
do_interrupt_handler+0xd4/0x138 arch/arm64/kernel/entry-common.c:216
__el1_irq arch/arm64/kernel/entry-common.c:568 [inline]
el1_interrupt+0x3c/0x60 arch/arm64/kernel/entry-common.c:581
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586
el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602
__daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P)
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P)
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] (P)
_raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:221 (P)
spin_unlock_irqrestore include/linux/spinlock.h:425 [inline]
__uart_port_unlock_irqrestore include/linux/serial_core.h:622 [inline]
pl011_console_device_unlock+0x94/0xcc drivers/tty/serial/amba-pl011.c:2721
nbcon_emit_one+0x160/0x1e4 kernel/printk/nbcon.c:1165
nbcon_kthread_func+0x56c/0x6c0 kernel/printk/nbcon.c:1271
kthread+0x304/0x3d4 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
irq event stamp: 19610
hardirqs last enabled at (19609): [<ffff80008688fdec>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline]
hardirqs last enabled at (19609): [<ffff80008688fdec>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221
hardirqs last disabled at (19610): [<ffff80008686ba58>] __el1_irq arch/arm64/kernel/entry-common.c:565 [inline]
hardirqs last disabled at (19610): [<ffff80008686ba58>] el1_interrupt+0x28/0x60 arch/arm64/kernel/entry-common.c:581
softirqs last enabled at (19568): [<ffff80008030a6dc>] softirq_handle_end kernel/softirq.c:491 [inline]
softirqs last enabled at (19568): [<ffff80008030a6dc>] handle_softirqs+0xb2c/0xcbc kernel/softirq.c:673
softirqs last disabled at (19425): [<ffff8000800203f0>] __do_softirq+0x14/0x20 kernel/softirq.c:679
---[ end trace 0000000000000000 ]---
Calling EFI runtime from hardirq context
------------[ cut here ]------------
WARNING: arch/arm64/kernel/traps.c:414 at force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414, CPU#0: pr/ttyAMA-1/41
Modules linked in:
CPU: 0 UID: 0 PID: 41 Comm: pr/ttyAMA-1 Tainted: G D W syzkaller #0 PREEMPT
Tainted: [D]=DIE, [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 034000c5 (nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
lr : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
sp : ffff80008eac71c0
x29: ffff80008eac71c0 x28: ffff80008eac74c0 x27: dfff800000000000
x26: 0000000000000000 x25: ffff80008efe0000 x24: dfff800000000000
x23: 0000000000000005 x22: 0000000000000009 x21: 0000000000000080
x20: 0000000000000000 x19: 0000000000000000 x18: 00000000ffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 00000000000009a7 x13: 0000000000000001 x12: 0000000000000003
x11: 0000000000000001 x10: 0000000001000005 x9 : 0000000001000004
x8 : ffff0000c24b9d80 x7 : 0000000000000001 x6 : ffff800080482944
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000801524f4
x2 : 0000000000000005 x1 : ffff0000c24b9d80 x0 : 0000000000000000
Call trace:
force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414 (P)
__efi_fpsimd_begin+0xd8/0x21c arch/arm64/kernel/fpsimd.c:2010
arch_efi_call_virt_setup+0xb4/0x254 arch/arm64/kernel/efi.c:187
virt_efi_set_variable_nb+0x9c/0x110 drivers/firmware/efi/runtime-wrappers.c:492
efivar_set_variable_locked+0x1cc/0x208 drivers/firmware/efi/vars.c:231
efi_pstore_write+0x2d4/0x418 drivers/firmware/efi/efi-pstore.c:227
pstore_dump+0x57c/0x8e8 fs/pstore/platform.c:355
kmsg_dump_desc+0x1f4/0x328 kernel/printk/printk.c:4880
kmsg_dump include/linux/kmsg_dump.h:123 [inline]
oops_exit+0x34/0x40 kernel/panic.c:1066
die+0xb8/0x1d4 arch/arm64/kernel/traps.c:224
die_kernel_fault+0x6c/0x80 arch/arm64/mm/fault.c:358
__do_kernel_fault+0x55c/0x590 arch/arm64/mm/fault.c:458
do_bad_area+0x7c/0x148 arch/arm64/mm/fault.c:533
do_translation_fault+0xdc/0x114 arch/arm64/mm/fault.c:851
do_mem_abort+0x70/0x194 arch/arm64/mm/fault.c:1012
el1_abort+0x50/0x74 arch/arm64/kernel/entry-common.c:380
el1h_64_sync_handler+0xdc/0x130 arch/arm64/kernel/entry-common.c:507
el1h_64_sync+0x78/0x7c arch/arm64/kernel/entry.S:601
blk_mq_complete_request_remote+0xc4/0x858 block/blk-mq.c:1310 (P)
nvme_try_complete_req drivers/nvme/host/nvme.h:839 [inline]
nvme_handle_cqe drivers/nvme/host/pci.c:1601 [inline]
nvme_poll_cq+0x544/0xfd8 drivers/nvme/host/pci.c:1632
nvme_irq+0x9c/0x120 drivers/nvme/host/pci.c:1646
__handle_irq_event_percpu+0x200/0x8ac kernel/irq/handle.c:209
handle_irq_event_percpu+0x2c/0xd8 kernel/irq/handle.c:246
handle_irq_event+0x98/0x188 kernel/irq/handle.c:263
handle_fasteoi_irq+0x328/0x864 kernel/irq/chip.c:768
generic_handle_irq_desc include/linux/irqdesc.h:188 [inline]
handle_irq_desc kernel/irq/irqdesc.c:679 [inline]
generic_handle_domain_irq+0xe4/0x154 kernel/irq/irqdesc.c:735
__gic_handle_irq drivers/irqchip/irq-gic-v3.c:825 [inline]
__gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:873 [inline]
gic_handle_irq+0x6c/0x180 drivers/irqchip/irq-gic-v3.c:917
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901
do_interrupt_handler+0xd4/0x138 arch/arm64/kernel/entry-common.c:216
__el1_irq arch/arm64/kernel/entry-common.c:568 [inline]
el1_interrupt+0x3c/0x60 arch/arm64/kernel/entry-common.c:581
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586
el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602
__daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P)
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P)
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] (P)
_raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:221 (P)
spin_unlock_irqrestore include/linux/spinlock.h:425 [inline]
__uart_port_unlock_irqrestore include/linux/serial_core.h:622 [inline]
pl011_console_device_unlock+0x94/0xcc drivers/tty/serial/amba-pl011.c:2721
nbcon_emit_one+0x160/0x1e4 kernel/printk/nbcon.c:1165
nbcon_kthread_func+0x56c/0x6c0 kernel/printk/nbcon.c:1271
kthread+0x304/0x3d4 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
irq event stamp: 19610
hardirqs last enabled at (19609): [<ffff80008688fdec>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline]
hardirqs last enabled at (19609): [<ffff80008688fdec>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221
hardirqs last disabled at (19610): [<ffff80008686ba58>] __el1_irq arch/arm64/kernel/entry-common.c:565 [inline]
hardirqs last disabled at (19610): [<ffff80008686ba58>] el1_interrupt+0x28/0x60 arch/arm64/kernel/entry-common.c:581
softirqs last enabled at (19568): [<ffff80008030a6dc>] softirq_handle_end kernel/softirq.c:491 [inline]
softirqs last enabled at (19568): [<ffff80008030a6dc>] handle_softirqs+0xb2c/0xcbc kernel/softirq.c:673
softirqs last disabled at (19425): [<ffff8000800203f0>] __do_softirq+0x14/0x20 kernel/softirq.c:679
---[ end trace 0000000000000000 ]---
Calling EFI runtime from hardirq context
------------[ cut here ]------------
WARNING: arch/arm64/kernel/traps.c:414 at force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414, CPU#0: pr/ttyAMA-1/41
Modules linked in:
CPU: 0 UID: 0 PID: 41 Comm: pr/ttyAMA-1 Tainted: G D W syzkaller #0 PREEMPT
Tainted: [D]=DIE, [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 034000c5 (nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
lr : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
sp : ffff80008eac71c0
x29: ffff80008eac71c0 x28: ffff80008eac74c0 x27: dfff800000000000
x26: 0000000000000000 x25: ffff80008efe0000 x24: dfff800000000000
x23: 0000000000000005 x22: 0000000000000009 x21: 0000000000000080
x20: 0000000000000000 x19: 0000000000000000 x18: 00000000ffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000a09 x13: 0000000000000001 x12: 0000000000000003
x11: 0000000000000001 x10: 0000000001000005 x9 : 0000000001000004
x8 : ffff0000c24b9d80 x7 : 0000000000000001 x6 : ffff800080482944
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000801524f4
x2 : 0000000000000005 x1 : ffff0000c24b9d80 x0 : 0000000000000000
Call trace:
force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414 (P)
__efi_fpsimd_begin+0xd8/0x21c arch/arm64/kernel/fpsimd.c:2010
arch_efi_call_virt_setup+0xb4/0x254 arch/arm64/kernel/efi.c:187
virt_efi_set_variable_nb+0x9c/0x110 drivers/firmware/efi/runtime-wrappers.c:492
efivar_set_variable_locked+0x1cc/0x208 drivers/firmware/efi/vars.c:231
efi_pstore_write+0x2d4/0x418 drivers/firmware/efi/efi-pstore.c:227
pstore_dump+0x57c/0x8e8 fs/pstore/platform.c:355
kmsg_dump_desc+0x1f4/0x328 kernel/printk/printk.c:4880
kmsg_dump include/linux/kmsg_dump.h:123 [inline]
oops_exit+0x34/0x40 kernel/panic.c:1066
die+0xb8/0x1d4 arch/arm64/kernel/traps.c:224
die_kernel_fault+0x6c/0x80 arch/arm64/mm/fault.c:358
__do_kernel_fault+0x55c/0x590 arch/arm64/mm/fault.c:458
do_bad_area+0x7c/0x148 arch/arm64/mm/fault.c:533
do_translation_fault+0xdc/0x114 arch/arm64/mm/fault.c:851
do_mem_abort+0x70/0x194 arch/arm64/mm/fault.c:1012
el1_abort+0x50/0x74 arch/arm64/kernel/entry-common.c:380
el1h_64_sync_handler+0xdc/0x130 arch/arm64/kernel/entry-common.c:507
el1h_64_sync+0x78/0x7c arch/arm64/kernel/entry.S:601
blk_mq_complete_request_remote+0xc4/0x858 block/blk-mq.c:1310 (P)
nvme_try_complete_req drivers/nvme/host/nvme.h:839 [inline]
nvme_handle_cqe drivers/nvme/host/pci.c:1601 [inline]
nvme_poll_cq+0x544/0xfd8 drivers/nvme/host/pci.c:1632
nvme_irq+0x9c/0x120 drivers/nvme/host/pci.c:1646
__handle_irq_event_percpu+0x200/0x8ac kernel/irq/handle.c:209
handle_irq_event_percpu+0x2c/0xd8 kernel/irq/handle.c:246
handle_irq_event+0x98/0x188 kernel/irq/handle.c:263
handle_fasteoi_irq+0x328/0x864 kernel/irq/chip.c:768
generic_handle_irq_desc include/linux/irqdesc.h:188 [inline]
handle_irq_desc kernel/irq/irqdesc.c:679 [inline]
generic_handle_domain_irq+0xe4/0x154 kernel/irq/irqdesc.c:735
__gic_handle_irq drivers/irqchip/irq-gic-v3.c:825 [inline]
__gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:873 [inline]
gic_handle_irq+0x6c/0x180 drivers/irqchip/irq-gic-v3.c:917
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901
do_interrupt_handler+0xd4/0x138 arch/arm64/kernel/entry-common.c:216
__el1_irq arch/arm64/kernel/entry-common.c:568 [inline]
el1_interrupt+0x3c/0x60 arch/arm64/kernel/entry-common.c:581
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586
el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602
__daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P)
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P)
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] (P)
_raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:221 (P)
spin_unlock_irqrestore include/linux/spinlock.h:425 [inline]
__uart_port_unlock_irqrestore include/linux/serial_core.h:622 [inline]
pl011_console_device_unlock+0x94/0xcc drivers/tty/serial/amba-pl011.c:2721
nbcon_emit_one+0x160/0x1e4 kernel/printk/nbcon.c:1165
nbcon_kthread_func+0x56c/0x6c0 kernel/printk/nbcon.c:1271
kthread+0x304/0x3d4 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
irq event stamp: 19610
hardirqs last enabled at (19609): [<ffff80008688fdec>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline]
hardirqs last enabled at (19609): [<ffff80008688fdec>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221
hardirqs last disabled at (19610): [<ffff80008686ba58>] __el1_irq arch/arm64/kernel/entry-common.c:565 [inline]
hardirqs last disabled at (19610): [<ffff80008686ba58>] el1_interrupt+0x28/0x60 arch/arm64/kernel/entry-common.c:581
softirqs last enabled at (19568): [<ffff80008030a6dc>] softirq_handle_end kernel/softirq.c:491 [inline]
softirqs last enabled at (19568): [<ffff80008030a6dc>] handle_softirqs+0xb2c/0xcbc kernel/softirq.c:673
softirqs last disabled at (19425): [<ffff8000800203f0>] __do_softirq+0x14/0x20 kernel/softirq.c:679
---[ end trace 0000000000000000 ]---
Calling EFI runtime from hardirq context
------------[ cut here ]------------
WARNING: arch/arm64/kernel/traps.c:414 at force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414, CPU#0: pr/ttyAMA-1/41
Modules linked in:
CPU: 0 UID: 0 PID: 41 Comm: pr/ttyAMA-1 Tainted: G D W syzkaller #0 PREEMPT
Tainted: [D]=DIE, [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 034000c5 (nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
lr : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
sp : ffff80008eac71c0
x29: ffff80008eac71c0 x28: ffff80008eac74c0 x27: dfff800000000000
x26: 0000000000000000 x25: ffff80008efe0000 x24: dfff800000000000
x23: 0000000000000005 x22: 0000000000000009 x21: 0000000000000080
x20: 0000000000000000 x19: 0000000000000000 x18: 00000000ffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000a6b x13: 0000000000000a6b x12: 0000000000000003
x11: 0000000000000001 x10: 0000000001000005 x9 : 0000000001000004
x8 : ffff0000c24b9d80 x7 : 0000000000000001 x6 : ffff800080482944
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000801524f4
x2 : 0000000000000005 x1 : ffff0000c24b9d80 x0 : 0000000000000000
Call trace:
force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414 (P)
__efi_fpsimd_begin+0xd8/0x21c arch/arm64/kernel/fpsimd.c:2010
arch_efi_call_virt_setup+0xb4/0x254 arch/arm64/kernel/efi.c:187
virt_efi_set_variable_nb+0x9c/0x110 drivers/firmware/efi/runtime-wrappers.c:492
efivar_set_variable_locked+0x1cc/0x208 drivers/firmware/efi/vars.c:231
efi_pstore_write+0x2d4/0x418 drivers/firmware/efi/efi-pstore.c:227
pstore_dump+0x57c/0x8e8 fs/pstore/platform.c:355
kmsg_dump_desc+0x1f4/0x328 kernel/printk/printk.c:4880
kmsg_dump include/linux/kmsg_dump.h:123 [inline]
oops_exit+0x34/0x40 kernel/panic.c:1066
die+0xb8/0x1d4 arch/arm64/kernel/traps.c:224
die_kernel_fault+0x6c/0x80 arch/arm64/mm/fault.c:358
__do_kernel_fault+0x55c/0x590 arch/arm64/mm/fault.c:458
do_bad_area+0x7c/0x148 arch/arm64/mm/fault.c:533
do_translation_fault+0xdc/0x114 arch/arm64/mm/fault.c:851
do_mem_abort+0x70/0x194 arch/arm64/mm/fault.c:1012
el1_abort+0x50/0x74 arch/arm64/kernel/entry-common.c:380
el1h_64_sync_handler+0xdc/0x130 arch/arm64/kernel/entry-common.c:507
el1h_64_sync+0x78/0x7c arch/arm64/kernel/entry.S:601
blk_mq_complete_request_remote+0xc4/0x858 block/blk-mq.c:1310 (P)
nvme_try_complete_req drivers/nvme/host/nvme.h:839 [inline]
nvme_handle_cqe drivers/nvme/host/pci.c:1601 [inline]
nvme_poll_cq+0x544/0xfd8 drivers/nvme/host/pci.c:1632
nvme_irq+0x9c/0x120 drivers/nvme/host/pci.c:1646
__handle_irq_event_percpu+0x200/0x8ac kernel/irq/handle.c:209
handle_irq_event_percpu+0x2c/0xd8 kernel/irq/handle.c:246
handle_irq_event+0x98/0x188 kernel/irq/handle.c:263
handle_fasteoi_irq+0x328/0x864 kernel/irq/chip.c:768
generic_handle_irq_desc include/linux/irqdesc.h:188 [inline]
handle_irq_desc kernel/irq/irqdesc.c:679 [inline]
generic_handle_domain_irq+0xe4/0x154 kernel/irq/irqdesc.c:735
__gic_handle_irq drivers/irqchip/irq-gic-v3.c:825 [inline]
__gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:873 [inline]
gic_handle_irq+0x6c/0x180 drivers/irqchip/irq-gic-v3.c:917
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901
do_interrupt_handler+0xd4/0x138 arch/arm64/kernel/entry-common.c:216
__el1_irq arch/arm64/kernel/entry-common.c:568 [inline]
el1_interrupt+0x3c/0x60 arch/arm64/kernel/entry-common.c:581
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586
el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602
__daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P)
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P)
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] (P)
_raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:221 (P)
spin_unlock_irqrestore include/linux/spinlock.h:425 [inline]
__uart_port_unlock_irqrestore include/linux/serial_core.h:622 [inline]
pl011_console_device_unlock+0x94/0xcc drivers/tty/serial/amba-pl011.c:2721
nbcon_emit_one+0x160/0x1e4 kernel/printk/nbcon.c:1165
nbcon_kthread_func+0x56c/0x6c0 kernel/printk/nbcon.c:1271
kthread+0x304/0x3d4 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
irq event stamp: 19610
hardirqs last enabled at (19609): [<ffff80008688fdec>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline]
hardirqs last enabled at (19609): [<ffff80008688fdec>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221
hardirqs last disabled at (19610): [<ffff80008686ba58>] __el1_irq arch/arm64/kernel/entry-common.c:565 [inline]
hardirqs last disabled at (19610): [<ffff80008686ba58>] el1_interrupt+0x28/0x60 arch/arm64/kernel/entry-common.c:581
softirqs last enabled at (19568): [<ffff80008030a6dc>] softirq_handle_end kernel/softirq.c:491 [inline]
softirqs last enabled at (19568): [<ffff80008030a6dc>] handle_softirqs+0xb2c/0xcbc kernel/softirq.c:673
softirqs last disabled at (19425): [<ffff8000800203f0>] __do_softirq+0x14/0x20 kernel/softirq.c:679
---[ end trace 0000000000000000 ]---
Calling EFI runtime from hardirq context
------------[ cut here ]------------
WARNING: arch/arm64/kernel/traps.c:414 at force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414, CPU#0: pr/ttyAMA-1/41
Modules linked in:
CPU: 0 UID: 0 PID: 41 Comm: pr/ttyAMA-1 Tainted: G D W syzkaller #0 PREEMPT
Tainted: [D]=DIE, [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 034000c5 (nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
lr : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
sp : ffff80008eac71c0
x29: ffff80008eac71c0 x28: ffff80008eac74c0 x27: dfff800000000000
x26: 0000000000000000 x25: ffff80008efe0000 x24: dfff800000000000
x23: 0000000000000005 x22: 0000000000000009 x21: 0000000000000080
x20: 0000000000000000 x19: 0000000000000000 x18: 00000000ffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000acd x13: 0000000000000001 x12: 0000000000000003
x11: 0000000000000001 x10: 0000000001000005 x9 : 0000000001000004
x8 : ffff0000c24b9d80 x7 : 0000000000000001 x6 : ffff800080482944
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000801524f4
x2 : 0000000000000005 x1 : ffff0000c24b9d80 x0 : 0000000000000000
Call trace:
force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414 (P)
__efi_fpsimd_begin+0xd8/0x21c arch/arm64/kernel/fpsimd.c:2010
arch_efi_call_virt_setup+0xb4/0x254 arch/arm64/kernel/efi.c:187
virt_efi_set_variable_nb+0x9c/0x110 drivers/firmware/efi/runtime-wrappers.c:492
efivar_set_variable_locked+0x1cc/0x208 drivers/firmware/efi/vars.c:231
efi_pstore_write+0x2d4/0x418 drivers/firmware/efi/efi-pstore.c:227
pstore_dump+0x57c/0x8e8 fs/pstore/platform.c:355
kmsg_dump_desc+0x1f4/0x328 kernel/printk/printk.c:4880
kmsg_dump include/linux/kmsg_dump.h:123 [inline]
oops_exit+0x34/0x40 kernel/panic.c:1066
die+0xb8/0x1d4 arch/arm64/kernel/traps.c:224
die_kernel_fault+0x6c/0x80 arch/arm64/mm/fault.c:358
__do_kernel_fault+0x55c/0x590 arch/arm64/mm/fault.c:458
do_bad_area+0x7c/0x148 arch/arm64/mm/fault.c:533
do_translation_fault+0xdc/0x114 arch/arm64/mm/fault.c:851
do_mem_abort+0x70/0x194 arch/arm64/mm/fault.c:1012
el1_abort+0x50/0x74 arch/arm64/kernel/entry-common.c:380
el1h_64_sync_handler+0xdc/0x130 arch/arm64/kernel/entry-common.c:507
el1h_64_sync+0x78/0x7c arch/arm64/kernel/entry.S:601
blk_mq_complete_request_remote+0xc4/0x858 block/blk-mq.c:1310 (P)
nvme_try_complete_req drivers/nvme/host/nvme.h:839 [inline]
nvme_handle_cqe drivers/nvme/host/pci.c:1601 [inline]
nvme_poll_cq+0x544/0xfd8 drivers/nvme/host/pci.c:1632
nvme_irq+0x9c/0x120 drivers/nvme/host/pci.c:1646
__handle_irq_event_percpu+0x200/0x8ac kernel/irq/handle.c:209
handle_irq_event_percpu+0x2c/0xd8 kernel/irq/handle.c:246
handle_irq_event+0x98/0x188 kernel/irq/handle.c:263
handle_fasteoi_irq+0x328/0x864 kernel/irq/chip.c:768
generic_handle_irq_desc include/linux/irqdesc.h:188 [inline]
handle_irq_desc kernel/irq/irqdesc.c:679 [inline]
generic_handle_domain_irq+0xe4/0x154 kernel/irq/irqdesc.c:735
__gic_handle_irq drivers/irqchip/irq-gic-v3.c:825 [inline]
__gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:873 [inline]
gic_handle_irq+0x6c/0x180 drivers/irqchip/irq-gic-v3.c:917
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901
do_interrupt_handler+0xd4/0x138 arch/arm64/kernel/entry-common.c:216
__el1_irq arch/arm64/kernel/entry-common.c:568 [inline]
el1_interrupt+0x3c/0x60 arch/arm64/kernel/entry-common.c:581
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586
el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602
__daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P)
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P)
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] (P)
_raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:221 (P)
spin_unlock_irqrestore include/linux/spinlock.h:425 [inline]
__uart_port_unlock_irqrestore include/linux/serial_core.h:622 [inline]
pl011_console_device_unlock+0x94/0xcc drivers/tty/serial/amba-pl011.c:2721
nbcon_emit_one+0x160/0x1e4 kernel/printk/nbcon.c:1165
nbcon_kthread_func+0x56c/0x6c0 kernel/printk/nbcon.c:1271
kthread+0x304/0x3d4 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
irq event stamp: 19610
hardirqs last enabled at (19609): [<ffff80008688fdec>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline]
hardirqs last enabled at (19609): [<ffff80008688fdec>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221
hardirqs last disabled at (19610): [<ffff80008686ba58>] __el1_irq arch/arm64/kernel/entry-common.c:565 [inline]
hardirqs last disabled at (19610): [<ffff80008686ba58>] el1_interrupt+0x28/0x60 arch/arm64/kernel/entry-common.c:581
softirqs last enabled at (19568): [<ffff80008030a6dc>] softirq_handle_end kernel/softirq.c:491 [inline]
softirqs last enabled at (19568): [<ffff80008030a6dc>] handle_softirqs+0xb2c/0xcbc kernel/softirq.c:673
softirqs last disabled at (19425): [<ffff8000800203f0>] __do_softirq+0x14/0x20 kernel/softirq.c:679
---[ end trace 0000000000000000 ]---
Calling EFI runtime from hardirq context
------------[ cut here ]------------
WARNING: arch/arm64/kernel/traps.c:414 at force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414, CPU#0: pr/ttyAMA-1/41
Modules linked in:
CPU: 0 UID: 0 PID: 41 Comm: pr/ttyAMA-1 Tainted: G D W syzkaller #0 PREEMPT
Tainted: [D]=DIE, [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 034000c5 (nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
lr : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
sp : ffff80008eac71c0
x29: ffff80008eac71c0 x28: ffff80008eac74c0 x27: dfff800000000000
x26: 0000000000000000 x25: ffff80008efe0000 x24: dfff800000000000
x23: 0000000000000005 x22: 0000000000000009 x21: 0000000000000080
x20: 0000000000000000 x19: 0000000000000000 x18: 00000000ffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000b2f x13: 0000000000000001 x12: 0000000000000003
x11: 0000000000000001 x10: 0000000001000005 x9 : 0000000001000004
x8 : ffff0000c24b9d80 x7 : 0000000000000001 x6 : ffff800080482944
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000801524f4
x2 : 0000000000000005 x1 : ffff0000c24b9d80 x0 : 0000000000000000
Call trace:
force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414 (P)
__efi_fpsimd_begin+0xd8/0x21c arch/arm64/kernel/fpsimd.c:2010
arch_efi_call_virt_setup+0xb4/0x254 arch/arm64/kernel/efi.c:187
virt_efi_set_variable_nb+0x9c/0x110 drivers/firmware/efi/runtime-wrappers.c:492
efivar_set_variable_locked+0x1cc/0x208 drivers/firmware/efi/vars.c:231
efi_pstore_write+0x2d4/0x418 drivers/firmware/efi/efi-pstore.c:227
pstore_dump+0x57c/0x8e8 fs/pstore/platform.c:355
kmsg_dump_desc+0x1f4/0x328 kernel/printk/printk.c:4880
kmsg_dump include/linux/kmsg_dump.h:123 [inline]
oops_exit+0x34/0x40 kernel/panic.c:1066
die+0xb8/0x1d4 arch/arm64/kernel/traps.c:224
die_kernel_fault+0x6c/0x80 arch/arm64/mm/fault.c:358
__do_kernel_fault+0x55c/0x590 arch/arm64/mm/fault.c:458
do_bad_area+0x7c/0x148 arch/arm64/mm/fault.c:533
do_translation_fault+0xdc/0x114 arch/arm64/mm/fault.c:851
do_mem_abort+0x70/0x194 arch/arm64/mm/fault.c:1012
el1_abort+0x50/0x74 arch/arm64/kernel/entry-common.c:380
el1h_64_sync_handler+0xdc/0x130 arch/arm64/kernel/entry-common.c:507
el1h_64_sync+0x78/0x7c arch/arm64/kernel/entry.S:601
blk_mq_complete_request_remote+0xc4/0x858 block/blk-mq.c:1310 (P)
nvme_try_complete_req drivers/nvme/host/nvme.h:839 [inline]
nvme_handle_cqe drivers/nvme/host/pci.c:1601 [inline]
nvme_poll_cq+0x544/0xfd8 drivers/nvme/host/pci.c:1632
nvme_irq+0x9c/0x120 drivers/nvme/host/pci.c:1646
__handle_irq_event_percpu+0x200/0x8ac kernel/irq/handle.c:209
handle_irq_event_percpu+0x2c/0xd8 kernel/irq/handle.c:246
handle_irq_event+0x98/0x188 kernel/irq/handle.c:263
handle_fasteoi_irq+0x328/0x864 kernel/irq/chip.c:768
generic_handle_irq_desc include/linux/irqdesc.h:188 [inline]
handle_irq_desc kernel/irq/irqdesc.c:679 [inline]
generic_handle_domain_irq+0xe4/0x154 kernel/irq/irqdesc.c:735
__gic_handle_irq drivers/irqchip/irq-gic-v3.c:825 [inline]
__gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:873 [inline]
gic_handle_irq+0x6c/0x180 drivers/irqchip/irq-gic-v3.c:917
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901
do_interrupt_handler+0xd4/0x138 arch/arm64/kernel/entry-common.c:216
__el1_irq arch/arm64/kernel/entry-common.c:568 [inline]
el1_interrupt+0x3c/0x60 arch/arm64/kernel/entry-common.c:581
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586
el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602
__daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P)
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P)
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] (P)
_raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:221 (P)
spin_unlock_irqrestore include/linux/spinlock.h:425 [inline]
__uart_port_unlock_irqrestore include/linux/serial_core.h:622 [inline]
pl011_console_device_unlock+0x94/0xcc drivers/tty/serial/amba-pl011.c:2721
nbcon_emit_one+0x160/0x1e4 kernel/printk/nbcon.c:1165
nbcon_kthread_func+0x56c/0x6c0 kernel/printk/nbcon.c:1271
kthread+0x304/0x3d4 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
irq event stamp: 19610
hardirqs last enabled at (19609): [<ffff80008688fdec>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline]
hardirqs last enabled at (19609): [<ffff80008688fdec>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221
hardirqs last disabled at (19610): [<ffff80008686ba58>] __el1_irq arch/arm64/kernel/entry-common.c:565 [inline]
hardirqs last disabled at (19610): [<ffff80008686ba58>] el1_interrupt+0x28/0x60 arch/arm64/kernel/entry-common.c:581
softirqs last enabled at (19568): [<ffff80008030a6dc>] softirq_handle_end kernel/softirq.c:491 [inline]
softirqs last enabled at (19568): [<ffff80008030a6dc>] handle_softirqs+0xb2c/0xcbc kernel/softirq.c:673
softirqs last disabled at (19425): [<ffff8000800203f0>] __do_softirq+0x14/0x20 kernel/softirq.c:679
---[ end trace 0000000000000000 ]---
Calling EFI runtime from hardirq context
------------[ cut here ]------------
WARNING: arch/arm64/kernel/traps.c:414 at force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414, CPU#0: pr/ttyAMA-1/41
Modules linked in:
CPU: 0 UID: 0 PID: 41 Comm: pr/ttyAMA-1 Tainted: G D W syzkaller #0 PREEMPT
Tainted: [D]=DIE, [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 034000c5 (nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
lr : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
sp : ffff80008eac71c0
x29: ffff80008eac71c0 x28: ffff80008eac74c0 x27: dfff800000000000
x26: 0000000000000000 x25: ffff80008efe0000 x24: dfff800000000000
x23: 0000000000000005 x22: 0000000000000009 x21: 0000000000000080
x20: 0000000000000000 x19: 0000000000000000 x18: 00000000ffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000b91 x13: 0000000000000001 x12: 0000000000000003
x11: 0000000000000001 x10: 0000000001000005 x9 : 0000000001000004
x8 : ffff0000c24b9d80 x7 : 0000000000000001 x6 : ffff800080482944
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000801524f4
x2 : 0000000000000005 x1 : ffff0000c24b9d80 x0 : 0000000000000000
Call trace:
force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414 (P)
__efi_fpsimd_begin+0xd8/0x21c arch/arm64/kernel/fpsimd.c:2010
arch_efi_call_virt_setup+0xb4/0x254 arch/arm64/kernel/efi.c:187
virt_efi_set_variable_nb+0x9c/0x110 drivers/firmware/efi/runtime-wrappers.c:492
efivar_set_variable_locked+0x1cc/0x208 drivers/firmware/efi/vars.c:231
efi_pstore_write+0x2d4/0x418 drivers/firmware/efi/efi-pstore.c:227
pstore_dump+0x57c/0x8e8 fs/pstore/platform.c:355
kmsg_dump_desc+0x1f4/0x328 kernel/printk/printk.c:4880
kmsg_dump include/linux/kmsg_dump.h:123 [inline]
oops_exit+0x34/0x40 kernel/panic.c:1066
die+0xb8/0x1d4 arch/arm64/kernel/traps.c:224
die_kernel_fault+0x6c/0x80 arch/arm64/mm/fault.c:358
__do_kernel_fault+0x55c/0x590 arch/arm64/mm/fault.c:458
do_bad_area+0x7c/0x148 arch/arm64/mm/fault.c:533
do_translation_fault+0xdc/0x114 arch/arm64/mm/fault.c:851
do_mem_abort+0x70/0x194 arch/arm64/mm/fault.c:1012
el1_abort+0x50/0x74 arch/arm64/kernel/entry-common.c:380
el1h_64_sync_handler+0xdc/0x130 arch/arm64/kernel/entry-common.c:507
el1h_64_sync+0x78/0x7c arch/arm64/kernel/entry.S:601
blk_mq_complete_request_remote+0xc4/0x858 block/blk-mq.c:1310 (P)
nvme_try_complete_req drivers/nvme/host/nvme.h:839 [inline]
nvme_handle_cqe drivers/nvme/host/pci.c:1601 [inline]
nvme_poll_cq+0x544/0xfd8 drivers/nvme/host/pci.c:1632
nvme_irq+0x9c/0x120 drivers/nvme/host/pci.c:1646
__handle_irq_event_percpu+0x200/0x8ac kernel/irq/handle.c:209
handle_irq_event_percpu+0x2c/0xd8 kernel/irq/handle.c:246
handle_irq_event+0x98/0x188 kernel/irq/handle.c:263
handle_fasteoi_irq+0x328/0x864 kernel/irq/chip.c:768
generic_handle_irq_desc include/linux/irqdesc.h:188 [inline]
handle_irq_desc kernel/irq/irqdesc.c:679 [inline]
generic_handle_domain_irq+0xe4/0x154 kernel/irq/irqdesc.c:735
__gic_handle_irq drivers/irqchip/irq-gic-v3.c:825 [inline]
__gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:873 [inline]
gic_handle_irq+0x6c/0x180 drivers/irqchip/irq-gic-v3.c:917
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901
do_interrupt_handler+0xd4/0x138 arch/arm64/kernel/entry-common.c:216
__el1_irq arch/arm64/kernel/entry-common.c:568 [inline]
el1_interrupt+0x3c/0x60 arch/arm64/kernel/entry-common.c:581
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586
el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602
__daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P)
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P)
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] (P)
_raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:221 (P)
spin_unlock_irqrestore include/linux/spinlock.h:425 [inline]
__uart_port_unlock_irqrestore include/linux/serial_core.h:622 [inline]
pl011_console_device_unlock+0x94/0xcc drivers/tty/serial/amba-pl011.c:2721
nbcon_emit_one+0x160/0x1e4 kernel/printk/nbcon.c:1165
nbcon_kthread_func+0x56c/0x6c0 kernel/printk/nbcon.c:1271
kthread+0x304/0x3d4 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
irq event stamp: 19610
hardirqs last enabled at (19609): [<ffff80008688fdec>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline]
hardirqs last enabled at (19609): [<ffff80008688fdec>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221
hardirqs last disabled at (19610): [<ffff80008686ba58>] __el1_irq arch/arm64/kernel/entry-common.c:565 [inline]
hardirqs last disabled at (19610): [<ffff80008686ba58>] el1_interrupt+0x28/0x60 arch/arm64/kernel/entry-common.c:581
softirqs last enabled at (19568): [<ffff80008030a6dc>] softirq_handle_end kernel/softirq.c:491 [inline]
softirqs last enabled at (19568): [<ffff80008030a6dc>] handle_softirqs+0xb2c/0xcbc kernel/softirq.c:673
softirqs last disabled at (19425): [<ffff8000800203f0>] __do_softirq+0x14/0x20 kernel/softirq.c:679
---[ end trace 0000000000000000 ]---
Calling EFI runtime from hardirq context
------------[ cut here ]------------
WARNING: arch/arm64/kernel/traps.c:414 at force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414, CPU#0: pr/ttyAMA-1/41
Modules linked in:
CPU: 0 UID: 0 PID: 41 Comm: pr/ttyAMA-1 Tainted: G D W syzkaller #0 PREEMPT
Tainted: [D]=DIE, [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 034000c5 (nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
lr : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
sp : ffff80008eac71c0
x29: ffff80008eac71c0 x28: ffff80008eac74c0 x27: dfff800000000000
x26: 0000000000000000 x25: ffff80008efe0000 x24: dfff800000000000
x23: 0000000000000005 x22: 0000000000000009 x21: 0000000000000080
x20: 0000000000000000 x19: 0000000000000000 x18: 00000000ffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000bf3 x13: 0000000000000001 x12: 0000000000000003
x11: 0000000000000001 x10: 0000000001000005 x9 : 0000000001000004
x8 : ffff0000c24b9d80 x7 : 0000000000000001 x6 : ffff800080482944
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000801524f4
x2 : 0000000000000005 x1 : ffff0000c24b9d80 x0 : 0000000000000000
Call trace:
force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414 (P)
__efi_fpsimd_begin+0xd8/0x21c arch/arm64/kernel/fpsimd.c:2010
arch_efi_call_virt_setup+0xb4/0x254 arch/arm64/kernel/efi.c:187
virt_efi_set_variable_nb+0x9c/0x110 drivers/firmware/efi/runtime-wrappers.c:492
efivar_set_variable_locked+0x1cc/0x208 drivers/firmware/efi/vars.c:231
efi_pstore_write+0x2d4/0x418 drivers/firmware/efi/efi-pstore.c:227
pstore_dump+0x57c/0x8e8 fs/pstore/platform.c:355
kmsg_dump_desc+0x1f4/0x328 kernel/printk/printk.c:4880
kmsg_dump include/linux/kmsg_dump.h:123 [inline]
oops_exit+0x34/0x40 kernel/panic.c:1066
die+0xb8/0x1d4 arch/arm64/kernel/traps.c:224
die_kernel_fault+0x6c/0x80 arch/arm64/mm/fault.c:358
__do_kernel_fault+0x55c/0x590 arch/arm64/mm/fault.c:458
do_bad_area+0x7c/0x148 arch/arm64/mm/fault.c:533
do_translation_fault+0xdc/0x114 arch/arm64/mm/fault.c:851
do_mem_abort+0x70/0x194 arch/arm64/mm/fault.c:1012
el1_abort+0x50/0x74 arch/arm64/kernel/entry-common.c:380
el1h_64_sync_handler+0xdc/0x130 arch/arm64/kernel/entry-common.c:507
el1h_64_sync+0x78/0x7c arch/arm64/kernel/entry.S:601
blk_mq_complete_request_remote+0xc4/0x858 block/blk-mq.c:1310 (P)
nvme_try_complete_req drivers/nvme/host/nvme.h:839 [inline]
nvme_handle_cqe drivers/nvme/host/pci.c:1601 [inline]
nvme_poll_cq+0x544/0xfd8 drivers/nvme/host/pci.c:1632
nvme_irq+0x9c/0x120 drivers/nvme/host/pci.c:1646
__handle_irq_event_percpu+0x200/0x8ac kernel/irq/handle.c:209
handle_irq_event_percpu+0x2c/0xd8 kernel/irq/handle.c:246
handle_irq_event+0x98/0x188 kernel/irq/handle.c:263
handle_fasteoi_irq+0x328/0x864 kernel/irq/chip.c:768
generic_handle_irq_desc include/linux/irqdesc.h:188 [inline]
handle_irq_desc kernel/irq/irqdesc.c:679 [inline]
generic_handle_domain_irq+0xe4/0x154 kernel/irq/irqdesc.c:735
__gic_handle_irq drivers/irqchip/irq-gic-v3.c:825 [inline]
__gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:873 [inline]
gic_handle_irq+0x6c/0x180 drivers/irqchip/irq-gic-v3.c:917
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901
do_interrupt_handler+0xd4/0x138 arch/arm64/kernel/entry-common.c:216
__el1_irq arch/arm64/kernel/entry-common.c:568 [inline]
el1_interrupt+0x3c/0x60 arch/arm64/kernel/entry-common.c:581
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586
el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602
__daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P)
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P)
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] (P)
_raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:221 (P)
spin_unlock_irqrestore include/linux/spinlock.h:425 [inline]
__uart_port_unlock_irqrestore include/linux/serial_core.h:622 [inline]
pl011_console_device_unlock+0x94/0xcc drivers/tty/serial/amba-pl011.c:2721
nbcon_emit_one+0x160/0x1e4 kernel/printk/nbcon.c:1165
nbcon_kthread_func+0x56c/0x6c0 kernel/printk/nbcon.c:1271
kthread+0x304/0x3d4 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
irq event stamp: 19610
hardirqs last enabled at (19609): [<ffff80008688fdec>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline]
hardirqs last enabled at (19609): [<ffff80008688fdec>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221
hardirqs last disabled at (19610): [<ffff80008686ba58>] __el1_irq arch/arm64/kernel/entry-common.c:565 [inline]
hardirqs last disabled at (19610): [<ffff80008686ba58>] el1_interrupt+0x28/0x60 arch/arm64/kernel/entry-common.c:581
softirqs last enabled at (19568): [<ffff80008030a6dc>] softirq_handle_end kernel/softirq.c:491 [inline]
softirqs last enabled at (19568): [<ffff80008030a6dc>] handle_softirqs+0xb2c/0xcbc kernel/softirq.c:673
softirqs last disabled at (19425): [<ffff8000800203f0>] __do_softirq+0x14/0x20 kernel/softirq.c:679
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: arch/arm64/kernel/traps.c:414 at force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414, CPU#0: pr/ttyAMA-1/41
Modules linked in:
CPU: 0 UID: 0 PID: 41 Comm: pr/ttyAMA-1 Tainted: G D W syzkaller #0 PREEMPT
Tainted: [D]=DIE, [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 034000c5 (nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
lr : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
sp : ffff80008eac71c0
x29: ffff80008eac71c0 x28: ffff80008eac74c0 x27: dfff800000000000
x26: 0000000000000000 x25: ffff80008efe0000 x24: dfff800000000000
x23: 0000000000000005 x22: 0000000000000009 x21: 0000000000000080
x20: 0000000000000000 x19: 0000000000000000 x18: 00000000ffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff700011153ff6 x9 : 0000000001000004
x8 : ffff0000c24b9d80 x7 : 0000000000000000 x6 : ffff800086845b5c
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff8000801524f4
x2 : 0000000000000005 x1 : ffff0000c24b9d80 x0 : 0000000000000000
Call trace:
force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414 (P)
__efi_fpsimd_begin+0xd8/0x21c arch/arm64/kernel/fpsimd.c:2010
arch_efi_call_virt_setup+0xb4/0x254 arch/arm64/kernel/efi.c:187
virt_efi_set_variable_nb+0x9c/0x110 drivers/firmware/efi/runtime-wrappers.c:492
efivar_set_variable_locked+0x1cc/0x208 drivers/firmware/efi/vars.c:231
efi_pstore_write+0x2d4/0x418 drivers/firmware/efi/efi-pstore.c:227
pstore_dump+0x57c/0x8e8 fs/pstore/platform.c:355
kmsg_dump_desc+0x1f4/0x328 kernel/printk/printk.c:4880
kmsg_dump include/linux/kmsg_dump.h:123 [inline]
oops_exit+0x34/0x40 kernel/panic.c:1066
die+0xb8/0x1d4 arch/arm64/kernel/traps.c:224
die_kernel_fault+0x6c/0x80 arch/arm64/mm/fault.c:358
__do_kernel_fault+0x55c/0x590 arch/arm64/mm/fault.c:458
do_bad_area+0x7c/0x148 arch/arm64/mm/fault.c:533
do_translation_fault+0xdc/0x114 arch/arm64/mm/fault.c:851
do_mem_abort+0x70/0x194 arch/arm64/mm/fault.c:1012
el1_abort+0x50/0x74 arch/arm64/kernel/entry-common.c:380
el1h_64_sync_handler+0xdc/0x130 arch/arm64/kernel/entry-common.c:507
el1h_64_sync+0x78/0x7c arch/arm64/kernel/entry.S:601
blk_mq_complete_request_remote+0xc4/0x858 block/blk-mq.c:1310 (P)
nvme_try_complete_req drivers/nvme/host/nvme.h:839 [inline]
nvme_handle_cqe drivers/nvme/host/pci.c:1601 [inline]
nvme_poll_cq+0x544/0xfd8 drivers/nvme/host/pci.c:1632
nvme_irq+0x9c/0x120 drivers/nvme/host/pci.c:1646
__handle_irq_event_percpu+0x200/0x8ac kernel/irq/handle.c:209
handle_irq_event_percpu+0x2c/0xd8 kernel/irq/handle.c:246
handle_irq_event+0x98/0x188 kernel/irq/handle.c:263
handle_fasteoi_irq+0x328/0x864 kernel/irq/chip.c:768
generic_handle_irq_desc include/linux/irqdesc.h:188 [inline]
handle_irq_desc kernel/irq/irqdesc.c:679 [inline]
generic_handle_domain_irq+0xe4/0x154 kernel/irq/irqdesc.c:735
__gic_handle_irq drivers/irqchip/irq-gic-v3.c:825 [inline]
__gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:873 [inline]
gic_handle_irq+0x6c/0x180 drivers/irqchip/irq-gic-v3.c:917
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901
do_interrupt_handler+0xd4/0x138 arch/arm64/kernel/entry-common.c:216
__el1_irq arch/arm64/kernel/entry-common.c:568 [inline]
el1_interrupt+0x3c/0x60 arch/arm64/kernel/entry-common.c:581
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586
el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602
__daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P)
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P)
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] (P)
_raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:221 (P)
spin_unlock_irqrestore include/linux/spinlock.h:425 [inline]
__uart_port_unlock_irqrestore include/linux/serial_core.h:622 [inline]
pl011_console_device_unlock+0x94/0xcc drivers/tty/serial/amba-pl011.c:2721
nbcon_emit_one+0x160/0x1e4 kernel/printk/nbcon.c:1165
nbcon_kthread_func+0x56c/0x6c0 kernel/printk/nbcon.c:1271
kthread+0x304/0x3d4 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
irq event stamp: 19610
hardirqs last enabled at (19609): [<ffff80008688fdec>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline]
hardirqs last enabled at (19609): [<ffff80008688fdec>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221
hardirqs last disabled at (19610): [<ffff80008686ba58>] __el1_irq arch/arm64/kernel/entry-common.c:565 [inline]
hardirqs last disabled at (19610): [<ffff80008686ba58>] el1_interrupt+0x28/0x60 arch/arm64/kernel/entry-common.c:581
softirqs last enabled at (19568): [<ffff80008030a6dc>] softirq_handle_end kernel/softirq.c:491 [inline]
softirqs last enabled at (19568): [<ffff80008030a6dc>] handle_softirqs+0xb2c/0xcbc kernel/softirq.c:673
softirqs last disabled at (19425): [<ffff8000800203f0>] __do_softirq+0x14/0x20 kernel/softirq.c:679
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: arch/arm64/kernel/traps.c:414 at force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414, CPU#0: pr/ttyAMA-1/41
Modules linked in:
CPU: 0 UID: 0 PID: 41 Comm: pr/ttyAMA-1 Tainted: G D W syzkaller #0 PREEMPT
Tainted: [D]=DIE, [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 034000c5 (nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
lr : force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414
sp : ffff80008eac71c0
x29: ffff80008eac71c0 x28: ffff80008eac74c0 x27: dfff800000000000
x26: 0000000000000000 x25: ffff80008efe0000 x24: dfff800000000000
x23: 0000000000000005 x22: 0000000000000009 x21: 0000000000000080
x20: 0000000000000000 x19: 0000000000000000 x18: 00000000ffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff700011153ff6 x9 : 0000000001000004
x8 : ffff0000c24b9d80 x7 : 0000000000000000 x6 : ffff800086845b5c
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff8000801524f4
x2 : 0000000000000005 x1 : ffff0000c24b9d80 x0 : 0000000000000000
Call trace:
force_signal_inject+0x150/0x168 arch/arm64/kernel/traps.c:414 (P)
__efi_fpsimd_begin+0xd8/0x21c arch/arm64/kernel/fpsimd.c:2010
arch_efi_call_virt_setup+0xb4/0x254 arch/arm64/kernel/efi.c:187
virt_efi_set_variable_nb+0x9c/0x110 drivers/firmware/efi/runtime-wrappers.c:492
efivar_set_variable_locked+0x1cc/0x208 drivers/firmware/efi/vars.c:231
efi_pstore_write+0x2d4/0x418 drivers/firmware/efi/efi-pstore.c:227
pstore_dump+0x57c/0x8e8 fs/pstore/platform.c:355
kmsg_dump_desc+0x1f4/0x328 kernel/printk/printk.c:4880
kmsg_dump include/linux/kmsg_dump.h:123 [inline]
oops_exit+0x34/0x40 kernel/panic.c:1066
die+0xb8/0x1d4 arch/arm64/kernel/traps.c:224
die_kernel_fault+0x6c/0x80 arch/arm64/mm/fault.c:358
__do_kernel_fault+0x55c/0x590 arch/arm64/mm/fault.c:458
do_bad_area+0x7c/0x148 arch/arm64/mm/fault.c:533
do_translation_fault+0xdc/0x114 arch/arm64/mm/fault.c:851
do_mem_abort+0x70/0x194 arch/arm64/mm/fault.c:1012
el1_abort+0x50/0x74 arch/arm64/kernel/entry-common.c:380
el1h_64_sync_handler+0xdc/0x130 arch/arm64/kernel/entry-common.c:507
el1h_64_sync+0x78/0x7c arch/arm64/kernel/entry.S:601
blk_mq_complete_request_remote+0xc4/0x858 block/blk-mq.c:1310 (P)
nvme_try_complete_req drivers/nvme/host/nvme.h:839 [inline]
nvme_handle_cqe drivers/nvme/host/pci.c:1601 [inline]
nvme_poll_cq+0x544/0xfd8 drivers/nvme/host/pci.c:1632
nvme_irq+0x9c/0x120 drivers/nvme/host/pci.c:1646
__handle_irq_event_percpu+0x200/0x8ac kernel/irq/handle.c:209
handle_irq_event_percpu+0x2c/0xd8 kernel/irq/handle.c:246
handle_irq_event+0x98/0x188 kernel/irq/handle.c:263
handle_fasteoi_irq+0x328/0x864 kernel/irq/chip.c:768
generic_handle_irq_desc include/linux/irqdesc.h:188 [inline]
handle_irq_desc kernel/irq/irqdesc.c:679 [inline]
generic_handle_domain_irq+0xe4/0x154 kernel/irq/irqdesc.c:735
__gic_handle_irq drivers/irqchip/irq-gic-v3.c:825 [inline]
__gic_handle_irq_from_irqson drivers/irqchip/irq-gic-v3.c:873 [inline]
gic_handle_irq+0x6c/0x180 drivers/irqchip/irq-gic-v3.c:917
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901
do_interrupt_handler+0xd4/0x138 arch/arm64/kernel/entry-common.c:216
__el1_irq arch/arm64/kernel/entry-common.c:568 [inline]
el1_interrupt+0x3c/0x60 arch/arm64/kernel/entry-common.c:581
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586
el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602
__daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P)
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P)
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline]
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2026-11-11 4:42 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <CAO7_G+wivY7+jm_JWMuXMa1+ttqNEiQ25iOdUyT=_CrnSEKGNA@mail.gmail.com>
2026-11-11 4:26 ` [syzbot] [block?] BUG: unable to handle kernel paging request in blk_mq_complete_request_remote syzbot
[not found] <CAO7_G+xxRab6PJQnffPhpV+fiYbEj85bDOLYO6Uho360ohVYLw@mail.gmail.com>
2026-11-11 4:42 ` syzbot
[not found] <CAO7_G+xNhBX9OmcoLHLA_ygEArCRGEVvX1fHgT5DJpoG26BbJQ@mail.gmail.com>
2026-11-11 4:27 ` syzbot
[not found] <CAO7_G+xfNddPzLFwOEK1nm06WbPMH2b_DgFNOHeE50Za0Zr+eQ@mail.gmail.com>
2026-11-11 4:26 ` syzbot
[not found] <CAO7_G+w-YoXKa7uTPZgu8JK=zvVOigzOjewNu=kZMZvGTxh8Jw@mail.gmail.com>
2026-11-10 22:09 ` syzbot
[not found] <CAO7_G+y3L5-N_-01cHPEbyvEob5mwgDCN2JgEHJoALzcptMX8A@mail.gmail.com>
2026-11-10 22:08 ` syzbot
[not found] <CAO7_G+wHdgLNKCbCGypfCUbp23eB+fdp-OmFRkn6WNnRTCfTkg@mail.gmail.com>
2026-11-10 21:49 ` syzbot
2026-11-11 1:13 ` Hristos Nenkov
2026-08-27 10:07 syzbot
2026-10-07 11:18 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®